In the Linux kernel, the following vulnerability has been resolved:

comedi: vmk80xx: fix transfer-buffer overflows

The driver uses endpoint-sized USB transfer buffers but up until
recently had no sanity checks on the sizes.

Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize
of usb endpoints found") inadvertently fixed NULL-pointer dereferences
when accessing the transfer buffers in case a malicious device has a
zero wMaxPacketSize.

Make sure to allocate buffers large enough to handle also the other
accesses that are done without a size check (e.g. byte 18 in
vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond
the buffers, for example, when doing descriptor fuzzing.

The original driver was for a low-speed device with 8-byte buffers.
Support was later added for a device that uses bulk transfers and is
presumably a full-speed device with a maximum 64-byte wMaxPacketSize.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00017.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
985cafccbf9b7f862aa1c5ee566801e18b5161fb affected < 5229159f1d052821007aff1a1beb7873eacf1a9f
985cafccbf9b7f862aa1c5ee566801e18b5161fb affected < ec85bcff4ed09260243d8f39faba99e1041718ba
985cafccbf9b7f862aa1c5ee566801e18b5161fb affected < 40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7
985cafccbf9b7f862aa1c5ee566801e18b5161fb affected < 7a2021b896de1ad559d33b5c5cdd20b982242088
985cafccbf9b7f862aa1c5ee566801e18b5161fb affected < 199acd8c110e3ae62833c24f632b0bb1c9f012a9
985cafccbf9b7f862aa1c5ee566801e18b5161fb affected < 33d7a470730dfe7c9bfc8da84575cf2cedd60d00
985cafccbf9b7f862aa1c5ee566801e18b5161fb affected < 278484ae93297b1bb1ce755f9d3b6d95a48c7d47
985cafccbf9b7f862aa1c5ee566801e18b5161fb affected < 06ac746d57e6d32b062e220415c607b7e2e0fa50
985cafccbf9b7f862aa1c5ee566801e18b5161fb affected < a23461c47482fc232ffc9b819539d1f837adf2b1
Linux Linux affected
Version Status Constraints
2.6.31 affected —
0 unaffected < 2.6.31
4.4.292 unaffected ≤ 4.4.*
4.9.290 unaffected ≤ 4.9.*
4.14.255 unaffected ≤ 4.14.*
4.19.217 unaffected ≤ 4.19.*
5.4.159 unaffected ≤ 5.4.*
5.10.79 unaffected ≤ 5.10.*
5.14.18 unaffected ≤ 5.14.*
5.15.2 unaffected ≤ 5.15.*
5.16 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50 cve-icon cve-icon
https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9 cve-icon cve-icon
https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47 cve-icon cve-icon
https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00 cve-icon cve-icon
https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 cve-icon cve-icon
https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f cve-icon cve-icon
https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088 cve-icon cve-icon
https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1 cve-icon cve-icon
https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024052236-CVE-2021-47475-6524@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47475 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47475 cve-icon
History

Wed, 24 Sep 2025 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 04 Nov 2024 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T07:11:43.980Z

Reserved: 2024-05-22T06:20:56.200Z

Link: CVE-2021-47475

cve-icon Vulnrichment

Updated: 2024-08-04T05:39:59.742Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-22T09:15:09.370

Modified: 2025-09-24T18:58:58.467

Link: CVE-2021-47475

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-05-22T00:00:00Z

Links: CVE-2021-47475 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-07-12T22:44:50Z

Weaknesses