PT-2024-11094 · Linux+2 · Linux Kernel+2

Wang Yugui · Published 2021-04-28 · Updated 2026-03-14 · CVE-2021-46987

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a deadlock that occurs when cloning inline extents and using qgroups in the btrfs file system. This happens because when reserving metadata space for a transaction, the system may need to flush existing delalloc in case there is not enough free space. A mechanism was introduced to prevent a deadlock, but when using qgroups, a transaction also reserves metadata qgroup space, which can result in flushing delalloc and cause a deadlock. The deadlock occurs because flushing delalloc requires locking the file range in the inode's iotree, and the range was already locked at the beginning of the clone operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

BDU:2025-06526

CVE-2021-46987

DLA-4327-1

OESA-2024-1298

OESA-2024-1299

OESA-2024-1300

OESA-2024-1301

SUSE-SU-2025:02846-1

SUSE-SU-2025_02846-1

Affected Products

Debian

Linux Kernel

Suse

References · 209

• https://nvd.nist.gov/vuln/detail/CVE-2021-46987 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2021-46987 · Vendor Advisory
• https://git.kernel.org/stable/c/f9baa501b4fd6962257853d46ddffbc21f27e344 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-52449 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52447 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46987 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE50 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46987 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52452 · Security Note
• https://bdu.fstec.ru/vul/2025-06526 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46987 · Vendor Advisory
• https://git.kernel.org/stable/c/96157707c0420e3d3edfe046f1cc797fee117ade · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02846-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52448 · Security Note