CVE-2021-47506: Linux Kernel use-after-free (CVSS 9.8)

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Kernel≥ 4.10 < 4.14.259 · ≥ 4.15 < 4.19.222 · ≥ 4.20 < 5.4.168 · ≥ 4.5 < 4.9.294

Remediation

Fixed in

Linux Kernel≥ 4.14.259

Patch & vendor advisories

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2021-47506 being actively exploited?

CVE-2021-47506 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.78%.

How severe is CVE-2021-47506?

CVE-2021-47506 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.78% probability of exploitation.

Which products are affected by CVE-2021-47506?

Affected products include Linux Kernel.

How do I fix CVE-2021-47506?

Upgrade affected software to a fixed version, for example Linux Kernel 4.14.259 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-47506 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo