PT-2024-11180 · Linux+1 · Linux Kernel+1

Published 2021-06-02 · Updated 2024-11-04 · CVE-2021-47130

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the Linux kernel's nvmet module, where it attempts to free memory from the wrong pool, causing a crash. Specifically, when a p2p device is found but the p2p pool is empty, the nvme target tries to free the sgl from the p2p pool instead of the regular sgl pool. This results in a kernel bug being called. The fix involves assigning the p2p dev for the request only if it was allocated from the p2p pool.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Allocation of Resources Without Limits

Weakness Enumeration

CWE-416

CWE-770

Related Identifiers

BDU:2025-07409

CVE-2021-47130

OPENSUSE-SU-2024_1489-1

SUSE-SU-2024:1465-1

SUSE-SU-2024:1489-1

Affected Products

Linux Kernel

Suse

References · 344

• https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271 · Patch
• https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-47130 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1489-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-47130 · Vendor Advisory
• https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3 · Patch
• https://osv.dev/vulnerability/CVE-2021-47130 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-47130 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1465-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47130 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-47130 · Security Note
• https://bdu.fstec.ru/vul/2025-07409 · Security Note
• https://bugzilla.suse.com/1221990 · Note
• https://suse.com/security/cve/CVE-2020-36781 · Note