CVE-2021-47492— mm, thp: bail out early in collapse_file for writeback page
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 99cb0dbd47a15d395bf3faa78dc122bc5efe3fc0< 69a7fa5cb0de06c8956b040f19a7248c8c8308ca | affected |
99cb0dbd47a15d395bf3faa78dc122bc5efe3fc0< 5e669d8ab30ab61dec3c36e27b4711f07611e6fc | affected | ||
99cb0dbd47a15d395bf3faa78dc122bc5efe3fc0< 74c42e1baacf206338b1dd6b6199ac964512b5bb | affected | ||
5.4 | affected | ||
< 5.4 | unaffected | ||
5.10.77≤ 5.10.* | unaffected | ||
5.14.16≤ 5.14.* | unaffected | ||
5.15≤ * | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-47492
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mm, thp: bail out early in collapse_file for writeback page
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mm, thp: bail out early in collapse_file for writeback page Currently collapse_file does not explicitly check PG_writeback, instead, page_has_private and try_to_release_page are used to filter writeback pages. This does not work for xfs with blocksize equal to or larger than pagesize, because in such case xfs has no page->private. This makes collapse_file bail out early for writeback page. Otherwise, xfs end_page_writeback will panic as follows. page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:ffff0003f88c86a8 index:0x0 pfn:0x84ef32 aops:xfs_address_space_operations [xfs] ino:30000b7 dentry name:"libtest.so" flags: 0x57fffe0000008027(locked|referenced|uptodate|active|writeback) raw: 57fffe0000008027 ffff80001b48bc28 ffff80001b48bc28 ffff0003f88c86a8 raw: 0000000000000000 0000000000000000 00000000ffffffff ffff0000c3e9a000 page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u)) page->mem_cgroup:ffff0000c3e9a000 ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:1212! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: BUG: Bad page state in process khugepaged pfn:84ef32 xfs(E) page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:0 index:0x0 pfn:0x84ef32 libcrc32c(E) rfkill(E) aes_ce_blk(E) crypto_simd(E) ... CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Tainted: ... pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) Call trace: end_page_writeback+0x1c0/0x214 iomap_finish_page_writeback+0x13c/0x204 iomap_finish_ioend+0xe8/0x19c iomap_writepage_end_bio+0x38/0x50 bio_endio+0x168/0x1ec blk_update_request+0x278/0x3f0 blk_mq_end_request+0x34/0x15c virtblk_request_done+0x38/0x74 [virtio_blk] blk_done_softirq+0xc4/0x110 __do_softirq+0x128/0x38c __irq_exit_rcu+0x118/0x150 irq_exit+0x1c/0x30 __handle_domain_irq+0x8c/0xf0 gic_handle_irq+0x84/0x108 el1_irq+0xcc/0x180 arch_cpu_idle+0x18/0x40 default_idle_call+0x4c/0x1a0 cpuidle_idle_call+0x168/0x1e0 do_idle+0xb4/0x104 cpu_startup_entry+0x30/0x9c secondary_start_kernel+0x104/0x180 Code: d4210000 b0006161 910c8021 94013f4d (d4210000) ---[ end trace 4a88c6a074082f8c ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞。攻击者利用该漏洞导致内核恐慌。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-47492
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47492
请登录查看更多情报信息。
Other References for CVE-2021-47492 (3)
Same Patch Batch · Linux · 2024-05-22 · 63 CVEs total
| CVE-2021-47496 | 9.8 CRITICAL | net/tls: Fix flipped sign in tls_err_abort() calls |
| CVE-2021-47478 | 9.1 CRITICAL | isofs: Fix out of bound access for corrupted isofs image |
| CVE-2021-47450 | 8.8 HIGH | KVM: arm64: Fix host stage-2 PGD refcount |
| CVE-2021-47433 | 8.1 HIGH | btrfs: fix abort logic in btrfs_replace_file_extents |
| CVE-2021-47459 | 7.8 HIGH | can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv |
| CVE-2021-47494 | 7.8 HIGH | cfg80211: fix management registrations locking |
| CVE-2021-47493 | 7.8 HIGH | ocfs2: fix race between searching chunks and release journal_head from buffer_head |
| CVE-2021-47483 | 7.8 HIGH | regmap: Fix possible double-free in regcache_rbtree_exit() |
| CVE-2021-47485 | 7.8 HIGH | IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields |
| CVE-2021-47446 | 7.8 HIGH | drm/msm/a4xx: fix error handling in a4xx_gpu_init() |
| CVE-2021-47447 | 7.8 HIGH | drm/msm/a3xx: fix error handling in a3xx_gpu_init() |
| CVE-2021-47461 | 7.8 HIGH | userfaultfd: fix a race between writeprotect and exit_mmap() |
| CVE-2021-47451 | 7.8 HIGH | netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value |
| CVE-2021-47448 | 7.5 HIGH | mptcp: fix possible stall on recvmsg() |
| CVE-2021-47438 | 7.1 HIGH | net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path |
| CVE-2021-47465 | 7.1 HIGH | KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() |
| CVE-2021-47458 | 7.1 HIGH | ocfs2: mount fails with buffer overflow in strlen |
| CVE-2021-47479 | staging: rtl8712: fix use-after-free in rtl8712_dl_fw | |
| CVE-2021-47477 | comedi: dt9812: fix DMA buffers on stack | |
| CVE-2021-47474 | comedi: vmk80xx: fix bulk-buffer overflow |
Showing top 20 of 63 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
Same vendor: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
V. Comments for CVE-2021-47492
No comments yet