{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47577","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-24T15:11:00.730Z","datePublished":"2024-06-19T14:53:45.393Z","dateUpdated":"2026-08-05T08:48:27.449Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:48:27.449Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: check for wq exit after adding new worker task_work\n\nWe check IO_WQ_BIT_EXIT before attempting to create a new worker, and\nwq exit cancels pending work if we have any. But it's possible to have\na race between the two, where creation checks exit finding it not set,\nbut we're in the process of exiting. The exit side will cancel pending\ncreation task_work, but there's a gap where we add task_work after we've\ncanceled existing creations at exit time.\n\nFix this by checking the EXIT bit post adding the creation task_work.\nIf it's set, run the same cancelation that exit does."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in io-wq worker creation used by io_uring and is reached only through local syscalls (io_uring_setup/io_uring_enter), not via network packet processing.\nAC:L - Although this is a race between worker creation and wq exit, the attacker controls both sides by submitting async io_uring work while concurrently exiting/closing the ring, and syzbot produced a C repro that triggers the UAF.\nPR:L - Basic io_uring_setup requires no capabilities; unprivileged local users can create rings and drive io-wq (io_uring_disabled was added years later and defaults to allowing all users).\nUI:N - Exploitation is entirely via the attacker's own io_uring syscalls and process lifecycle; no victim action is required.\nS:U - Impact stays within the host kernel authority (local memory corruption / privilege escalation / DoS), with no VM escape or other cross-boundary scope change.\nC:H - Syzbot confirmed a use-after-free write on a freed kmalloc-512 io_worker; UAF enables heap reuse and arbitrary kernel memory read primitives.\nI:H - The UAF write through freed worker create_state/task_work state can be turned into an arbitrary write and control-flow hijack via heap spraying of the reused object.\nA:H - The UAF causes kernel oops/panic under KASAN and can crash or hang the system even when not fully exploited for code execution."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/io-wq.c"],"versions":[{"version":"685fe7feedb96771683437107ba72131410e2350","lessThan":"4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec","status":"affected","versionType":"git"},{"version":"685fe7feedb96771683437107ba72131410e2350","lessThan":"71a85387546e50b1a37b0fa45dadcae3bfb35cf6","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/io-wq.c"],"versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","status":"unaffected","versionType":"semver"},{"version":"5.15.11","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.16","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.15.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.16"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec"},{"url":"https://git.kernel.org/stable/c/71a85387546e50b1a37b0fa45dadcae3bfb35cf6"}],"title":"io-wq: check for wq exit after adding new worker task_work","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-21T14:05:50.192086Z","id":"CVE-2021-47577","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-21T14:06:00.767Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T05:39:59.773Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/71a85387546e50b1a37b0fa45dadcae3bfb35cf6","tags":["x_transferred"]}]}]}}