PT-2024-11176 · Linux · Linux Kernel

Published 2021-05-08 · Updated 2024-03-17 · CVE-2021-47124

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the io uring feature in the Linux kernel, where the io link timeout fn() function should put only one reference of the linked timeout request. However, in cases of racing with the master request's completion, first io req complete() puts one and then io put req deferred() is called. This can lead to problems with reference counting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-13696

CVE-2021-47124

Affected Products

Linux Kernel

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2021-47124 · Security Note
• https://git.kernel.org/stable/c/876808dba2ff7509bdd7f230c4f374a0caf4f410 · Patch
• https://git.kernel.org/stable/c/ff4a96ba5c8f9b266706280ff8021d2ef3f17e86 · Patch
• https://git.kernel.org/stable/c/6f5d7a45f58d3abe3a936de1441b8d6318f978ff · Patch
• https://ubuntu.com/security/CVE-2021-47124 · Vendor Advisory
• https://git.kernel.org/stable/c/0b2a990e5d2f76d020cb840c456e6ec5f0c27530 · Patch
• https://git.kernel.org/stable/c/a298232ee6b9a1d5d732aa497ff8be0d45b5bd82 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47124 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-47124 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-47124 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-47124 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13696 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47124 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.19 · Note
• https://git.kernel.org/linus/a298232ee6b9a1d5d732aa497ff8be0d45b5bd82 · Note