In the Linux kernel, the following vulnerability has been resolved:

ftrace: Do not blindly read the ip address in ftrace_bug()

It was reported that a bug on arm64 caused a bad ip address to be used for
updating into a nop in ftrace_init(), but the error path (rightfully)
returned -EINVAL and not -EFAULT, as the bug caused more than one error to
occur. But because -EINVAL was returned, the ftrace_bug() tried to report
what was at the location of the ip address, and read it directly. This
caused the machine to panic, as the ip was not pointing to a valid memory
address.

Instead, read the ip address with copy_from_kernel_nofault() to safely
access the memory, and if it faults, report that the address faulted,
otherwise report what was in that location.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
05736a427f7e16be948ccbf39782bd3a6ae16b14 affected < 0bc62e398bbd9e600959e610def5109957437b28
05736a427f7e16be948ccbf39782bd3a6ae16b14 affected < 4aedc2bc2b32c93555f47c95610efb89cc1ec09b
05736a427f7e16be948ccbf39782bd3a6ae16b14 affected < acf671ba79c1feccc3ec7cfdcffead4efcec49e7
05736a427f7e16be948ccbf39782bd3a6ae16b14 affected < 862dcc14f2803c556bdd73b43c27b023fafce2fb
05736a427f7e16be948ccbf39782bd3a6ae16b14 affected < 7e4e824b109f1d41ccf223fbb0565d877d6223a2
05736a427f7e16be948ccbf39782bd3a6ae16b14 affected < 97524384762c1fb9b3ded931498dd2047bd0de81
05736a427f7e16be948ccbf39782bd3a6ae16b14 affected < 3e4ddeb68751fb4fb657199aed9cfd5d02796875
05736a427f7e16be948ccbf39782bd3a6ae16b14 affected < 6c14133d2d3f768e0a35128faac8aa6ed4815051
Linux Linux affected
Version Status Constraints
2.6.28 affected —
0 unaffected < 2.6.28
4.4.273 unaffected ≤ 4.4.*
4.9.273 unaffected ≤ 4.9.*
4.14.237 unaffected ≤ 4.14.*
4.19.195 unaffected ≤ 4.19.*
5.4.126 unaffected ≤ 5.4.*
5.10.44 unaffected ≤ 5.10.*
5.12.11 unaffected ≤ 5.12.*
5.13 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0bc62e398bbd9e600959e610def5109957437b28 cve-icon cve-icon
https://git.kernel.org/stable/c/3e4ddeb68751fb4fb657199aed9cfd5d02796875 cve-icon cve-icon
https://git.kernel.org/stable/c/4aedc2bc2b32c93555f47c95610efb89cc1ec09b cve-icon cve-icon
https://git.kernel.org/stable/c/6c14133d2d3f768e0a35128faac8aa6ed4815051 cve-icon cve-icon
https://git.kernel.org/stable/c/7e4e824b109f1d41ccf223fbb0565d877d6223a2 cve-icon cve-icon
https://git.kernel.org/stable/c/862dcc14f2803c556bdd73b43c27b023fafce2fb cve-icon cve-icon
https://git.kernel.org/stable/c/97524384762c1fb9b3ded931498dd2047bd0de81 cve-icon cve-icon
https://git.kernel.org/stable/c/acf671ba79c1feccc3ec7cfdcffead4efcec49e7 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024052152-CVE-2021-47276-7574@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47276 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47276 cve-icon
History

Wed, 30 Apr 2025 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-706
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Fri, 20 Dec 2024 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T07:07:43.402Z

Reserved: 2024-05-21T13:27:52.128Z

Link: CVE-2021-47276

cve-icon Vulnrichment

Updated: 2024-08-04T05:32:07.996Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-21T15:15:15.983

Modified: 2025-04-30T14:46:07.833

Link: CVE-2021-47276

cve-icon Redhat

Severity : Low

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2021-47276 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses