Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2021-47341— KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于内存释放后重用。

CVSS 7.8 · High EPSS 0.26% · P16 Updated Aug 05, 2026

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 17

Vendor	Product	Version Range	Status
Linux	Linux	`7d1bc32d6477ff96a32695ea4be8144e4513ab2d< f2ff9d03432fcb160e9f7d4be26174d89de2779a`	affected
		`2a20592baff59c5351c5200ec667e1a2aa22af85< 679837dc0abaa2c6e2a7bcd86483e05eee1d5066`	affected
		`50cbad42bfea8c052b7ca590bd4126cdc898713c< 8d7c539316d652d217e5e82b89ee204c812a7061`	affected
		`5d3c4c79384af06e3c8e25b7770b6247496b4417< 069d44a24c0ff8f85adf49233aae7a8ca16f5c7e`	affected
		`5d3c4c79384af06e3c8e25b7770b6247496b4417< 23fa2e46a5556f787ce2ea1a315d3ab93cced204`	affected
		`168e82f640ed1891a700bdb43e37da354b2ab63c`	affected
		`5.4.119< 5.4.134`	affected
		`5.10.37< 5.10.52`	affected
… +9 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47341

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio BUG: KASAN: use-after-free in kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183 Read of size 8 at addr ffff0000c03a2500 by task syz-executor083/4269 CPU: 5 PID: 4269 Comm: syz-executor083 Not tainted 5.10.0 #7 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132 show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x110/0x164 lib/dump_stack.c:118 print_address_description+0x78/0x5c8 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report+0x148/0x1e4 mm/kasan/report.c:562 check_memory_region_inline mm/kasan/generic.c:183 [inline] __asan_load8+0xb4/0xbc mm/kasan/generic.c:252 kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183 kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common arch/arm64/kernel/syscall.c:158 [inline] do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670 Allocated by task 4269: stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461 kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475 kmem_cache_alloc_trace include/linux/slab.h:450 [inline] kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:664 [inline] kvm_vm_ioctl_register_coalesced_mmio+0x78/0x1cc arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:146 kvm_vm_ioctl+0x7e8/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3746 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common arch/arm64/kernel/syscall.c:158 [inline] do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670 Freed by task 4269: stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_set_track+0x38/0x6c mm/kasan/common.c:56 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355 __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422 kasan_slab_free+0x10/0x1c mm/kasan/common.c:431 slab_free_hook mm/slub.c:1544 [inline] slab_free_freelist_hook mm/slub.c:1577 [inline] slab_free mm/slub.c:3142 [inline] kfree+0x104/0x38c mm/slub.c:4124 coalesced_mmio_destructor+0x94/0xa4 arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:102 kvm_iodevice_destructor include/kvm/iodev.h:61 [inline] kvm_io_bus_unregister_dev+0x248/0x280 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:4374 kvm_vm_ioctl_unregister_coalesced_mmio+0x158/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:186 kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/sys ---truncated---

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于内存释放后重用。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	7d1bc32d6477ff96a32695ea4be8144e4513ab2d ~ f2ff9d03432fcb160e9f7d4be26174d89de2779a	-
Linux	Linux	5.13	-

II. Public POCs for CVE-2021-47341

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2021-47341

请登录查看更多情报信息。

Other References for CVE-2021-47341 (5)

https://www.cve.org/CVERecord?id=CVE-2021-47341

Same Patch Batch · Linux · 2024-05-21 · 361 CVEs total

CVE-2023-52732	9.8 CRITICAL	ceph: blocklist the kclient when receiving corrupted snap trace
CVE-2023-52755	9.8 CRITICAL	ksmbd: fix slab out of bounds write in smb_inherit_dacl()
CVE-2021-47378	9.8 CRITICAL	nvme-rdma: destroy cm id before destroy qp to avoid use after free
CVE-2021-47328	9.8 CRITICAL	scsi: iscsi: Fix conn use after free during resets
CVE-2021-47232	9.8 CRITICAL	can: j1939: fix Use-after-Free, hold skb ref while in use
CVE-2023-52741	9.8 CRITICAL	cifs: Fix use-after-free in rdata->read_into_pages()
CVE-2021-47427	9.8 CRITICAL	scsi: iscsi: Fix iscsi_task use after free
CVE-2021-47308	8.8 HIGH	scsi: libfc: Fix array index out of bound exception
CVE-2023-52776	8.8 HIGH	wifi: ath12k: fix dfs-radar and temperature event locking
CVE-2021-47388	8.8 HIGH	mac80211: fix use-after-free in CCMP/GCMP RX
CVE-2023-52801	8.8 HIGH	iommufd: Fix missing update of domains_itree after splitting iopt_area
CVE-2023-52798	8.8 HIGH	wifi: ath11k: fix dfs radar event locking
CVE-2021-47390	8.8 HIGH	KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()
CVE-2023-52769	8.8 HIGH	wifi: ath12k: fix htt mlo-offset event locking
CVE-2023-52846	8.8 HIGH	hsr: Prevent use after free in prp_create_tagged_frame()
CVE-2023-52790	8.8 HIGH	swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC
CVE-2021-47240	8.4 HIGH	net: qrtr: fix OOB Read in qrtr_endpoint_post
CVE-2021-47352	8.4 HIGH	virtio-net: Add validation for used length
CVE-2023-52829	8.4 HIGH	wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps()
CVE-2021-47244	8.2 HIGH	mptcp: Fix out of bounds when parsing TCP options

Showing top 20 of 361 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2021-47341

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2021-47341— KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 17

I. Basic Information for CVE-2021-47341

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2021-47341

III. Intelligence Information for CVE-2021-47341

Other References for CVE-2021-47341 (5)

Same Patch Batch · Linux · 2024-05-21 · 361 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2021-47341

Leave a comment