In the Linux kernel, the following vulnerability has been resolved:

KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU

If allocating a new instance of an I/O bus fails when unregistering a
device, wait to destroy the device until after all readers are guaranteed
to see the new null bus. Destroying devices before the bus is nullified
could lead to use-after-free since readers expect the devices on their
reference of the bus to remain valid.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00016.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f65886606c2d3b562716de030706dfe1bea4ed5e affected < 03c6cccedd3913006744faa252a4da5145299343
f65886606c2d3b562716de030706dfe1bea4ed5e affected < 4e899ca848636b37e9ac124bc1723862a7d7d927
f65886606c2d3b562716de030706dfe1bea4ed5e affected < 30f46c6993731efb2a690c9197c0fd9ed425da2d
f65886606c2d3b562716de030706dfe1bea4ed5e affected < 2ee3757424be7c1cd1d0bbfa6db29a7edd82a250
f0dfffce3f4ffd5f822568a4a6fb34c010e939d1 affected —
840e124f89a5127e7eb97ebf377f4b8ca745c070 affected —
40a023f681befd9b2862a3c16fb306a38b359ae5 affected —
19184bd06f488af62924ff1747614a8cb284ad63 affected —
41b2ea7a6a11e2b1a7f2c29e1675a709a6b2b98d affected —
68c125324b5e1d1d22805653735442923d896a1d affected —
Linux Linux affected
Version Status Constraints
5.9 affected —
0 unaffected < 5.9
5.10.37 unaffected ≤ 5.10.*
5.11.21 unaffected ≤ 5.11.*
5.12.4 unaffected ≤ 5.12.*
5.13 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343 cve-icon cve-icon
https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250 cve-icon cve-icon
https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d cve-icon cve-icon
https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024022952-CVE-2021-47061-6fea@gregkh/T/#u cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47061 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47061 cve-icon
History

Tue, 10 Dec 2024 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 04 Nov 2024 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T12:41:01.255Z

Reserved: 2024-02-29T22:33:44.294Z

Link: CVE-2021-47061

cve-icon Vulnrichment

Updated: 2024-08-04T05:24:39.011Z

cve-icon NVD

Status : Analyzed

Published: 2024-02-29T23:15:07.793

Modified: 2024-12-10T16:55:15.017

Link: CVE-2021-47061

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-02-29T00:00:00Z

Links: CVE-2021-47061 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses