PT-2024-11150 · Linux · Linux Kernel

Filipe Manana · Published 2021-05-14 · Updated 2025-01-09 · CVE-2021-47072

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The vulnerability is related to the btrfs file system in the Linux kernel. When an inode is moved from one directory to another and both the inode and its previous parent directory were logged before, the dentry for the old parent should not exist after a power failure if the log is synced. However, there is a scenario where this does not work correctly because the old parent of the file/directory that was moved is not authoritative for a range that includes the dir index and dir item keys of the old dentry. This can be triggered by a specific layout of keys and items in the fs/subvolume btree.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-99

Related Identifiers

BDU:2025-05172

CVE-2021-47072

Affected Products

Linux Kernel

References · 13

• https://cve.org/CVERecord?id=CVE-2021-47072 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47072 · Security Note
• https://ubuntu.com/security/CVE-2021-47072 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05172 · Security Note
• https://git.kernel.org/stable/c/6d0924c5b742036b4f20a0ffdf2b6cf3f963f5f6 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47072 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-47072 · Vendor Advisory
• https://git.kernel.org/stable/c/54a40fc3a1da21b52dbf19f72fdc27a2ec740760 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47072 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.7 · Note
• https://git.kernel.org/linus/54a40fc3a1da21b52dbf19f72fdc27a2ec740760 · Note
• https://lore.kernel.org/linux-cve-announce/2024030141-CVE-2021-47072-52d4@gregkh · Note
• https://lore.kernel.org/linux-cve-announce/2024030141-CVE-2021-47072-52d4@gregkh/T/#u · Note