{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47130","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-03-04T18:12:48.840Z","datePublished":"2024-03-15T20:14:33.955Z","dateUpdated":"2026-08-05T08:46:12.154Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:46:12.154Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix freeing unallocated p2pmem\n\nIn case p2p device was found but the p2p pool is empty, the nvme target\nis still trying to free the sgl from the p2p pool instead of the\nregular sgl pool and causing a crash (BUG() is called). Instead, assign\nthe p2p_dev for the request only if it was allocated from p2p pool.\n\nThis is the crash that was caused:\n\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\n[Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI\n...\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\n...\n[Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0\n...\n[Sun May 30 19:13:53 2021] Call Trace:\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\n[Sun May 30 19:13:53 2021]  pci_free_p2pmem+0x2b/0x70\n[Sun May 30 19:13:53 2021]  pci_p2pmem_free_sgl+0x4f/0x80\n[Sun May 30 19:13:53 2021]  nvmet_req_free_sgls+0x1e/0x80 [nvmet]\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\n[Sun May 30 19:13:53 2021]  nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma]\n[Sun May 30 19:13:53 2021]  nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The buggy SGL alloc/free path is reached only from nvmet-rdma (`nvmet_rdma_map_sgl_keyed` → `nvmet_req_alloc_sgls` / `nvmet_rdma_release_rsp` → `nvmet_req_free_sgls`), which processes NVMe-oF commands from a remote RDMA/RoCE peer over the network.\nAC:L - In a p2pmem-enabled target deployment, an attacker who can issue I/O controls transfer size and concurrency and can force `pci_p2pmem_alloc_sgl()` to fail so the regular SGL fallback runs with `req->p2p_dev` still set; the subsequent free reliably hits `BUG()` in `gen_pool_free_owner()`.\nPR:N - At this vintage there was no DH-CHAP in-band auth, and with `allow_any_host` (a common nvmet config) any network peer can CONNECT and issue I/O; host NQN allowlisting alone is not a credential check, so this matches unauthenticated nvmet DoS scoring (e.g. CVE-2026-22998).\nUI:N - No victim user action is required once the NVMe target is configured and listening; the attacker only needs to connect and send I/O that exercises the p2pmem fallback path.\nS:U - Impact is a kernel BUG/oops in the same host kernel authority as the nvmet target; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:N - The defect frees a regular SGL through the p2pmem free path and terminates in `BUG()` when the address is not in the p2p gen_pool; it does not disclose kernel memory.\nI:N - This is a wrong-allocator free that hits an intentional `BUG()` rather than a use-after-free, OOB write, or other memory-corruption primitive usable for integrity compromise or code execution.\nA:H - Successful trigger causes `kernel BUG at lib/genalloc.c` (`gen_pool_free_owner`), producing a kernel oops/panic and denial of service of the target host."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/core.c"],"versions":[{"version":"c6e3f13398123a008cd2ee28f93510b113a32791","lessThan":"c440cd080761b18a52cac20f2a42e5da1e3995af","status":"affected","versionType":"git"},{"version":"c6e3f13398123a008cd2ee28f93510b113a32791","lessThan":"8a452d62e7cea3c8a2676a3b89a9118755a1a271","status":"affected","versionType":"git"},{"version":"c6e3f13398123a008cd2ee28f93510b113a32791","lessThan":"bcd9a0797d73eeff659582f23277e7ab6e5f18f3","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/core.c"],"versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","status":"unaffected","versionType":"semver"},{"version":"5.10.43","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.12.10","lessThanOrEqual":"5.12.*","status":"unaffected","versionType":"semver"},{"version":"5.13","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.10.43"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.12.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.13"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af"},{"url":"https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271"},{"url":"https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3"}],"title":"nvmet: fix freeing unallocated p2pmem","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.4,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-03-18T15:12:36.061889Z","id":"CVE-2021-47130","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-11-04T17:09:52.222Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T05:24:39.944Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3","tags":["x_transferred"]}]}]}}