CVE-2021-46984 (GCVE-0-2021-46984)
Vulnerability from cvelistv5
Published
2024-02-28 08:13
Modified
2026-08-05 08:45
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: kyber: fix out of bounds access when preempted __blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and passes the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx for the current CPU again and uses that to get the corresponding Kyber context in the passed hctx. However, the thread may be preempted between the two calls to blk_mq_get_ctx(), and the ctx returned the second time may no longer correspond to the passed hctx. This "works" accidentally most of the time, but it can cause us to read garbage if the second ctx came from an hctx with more ctx's than the first one (i.e., if ctx->index_hw[hctx->type] > hctx->nr_ctx). This manifested as this UBSAN array index out of bounds error reported by Jakub: UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9 index 13106 is out of range for type 'long unsigned int [128]' Call Trace: dump_stack+0xa4/0xe5 ubsan_epilogue+0x5/0x40 __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34 queued_spin_lock_slowpath+0x476/0x480 do_raw_spin_lock+0x1c2/0x1d0 kyber_bio_merge+0x112/0x180 blk_mq_submit_bio+0x1f5/0x1100 submit_bio_noacct+0x7b0/0x870 submit_bio+0xc2/0x3a0 btrfs_map_bio+0x4f0/0x9d0 btrfs_submit_data_bio+0x24e/0x310 submit_one_bio+0x7f/0xb0 submit_extent_page+0xc4/0x440 __extent_writepage_io+0x2b8/0x5e0 __extent_writepage+0x28d/0x6e0 extent_write_cache_pages+0x4d7/0x7a0 extent_writepages+0xa2/0x110 do_writepages+0x8f/0x180 __writeback_single_inode+0x99/0x7f0 writeback_sb_inodes+0x34e/0x790 __writeback_inodes_wb+0x9e/0x120 wb_writeback+0x4d2/0x660 wb_workfn+0x64d/0xa10 process_one_work+0x53a/0xa80 worker_thread+0x69/0x5b0 kthread+0x20b/0x240 ret_from_fork+0x1f/0x30 Only Kyber uses the hctx, so fix it by passing the request_queue to ->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can map the queues itself to avoid the mismatch.
References
Impacted products
Vendor Product Version
Linux Linux Version: a6088845c2bf754d6cb2572b484180680b037804
Version: a6088845c2bf754d6cb2572b484180680b037804
Version: a6088845c2bf754d6cb2572b484180680b037804
Version: a6088845c2bf754d6cb2572b484180680b037804
Version: a6088845c2bf754d6cb2572b484180680b037804
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:37.898Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0b6b4b90b74c27bea968c214d820ba4254b903a5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/54dbe2d2c1fcabf650c7a8b747601da355cd7f9f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a287cd84e047045f5a4d4da793414e848de627c6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2ef3c76540c49167a0bc3d5f80d00fd1fc4586df"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/efed9a3337e341bd0989161b97453b52567bc59d"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46984",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:01:11.596982Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:40.792Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/bfq-iosched.c",
            "block/blk-mq-sched.c",
            "block/kyber-iosched.c",
            "block/mq-deadline.c",
            "include/linux/elevator.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b6b4b90b74c27bea968c214d820ba4254b903a5",
              "status": "affected",
              "version": "a6088845c2bf754d6cb2572b484180680b037804",
              "versionType": "git"
            },
            {
              "lessThan": "54dbe2d2c1fcabf650c7a8b747601da355cd7f9f",
              "status": "affected",
              "version": "a6088845c2bf754d6cb2572b484180680b037804",
              "versionType": "git"
            },
            {
              "lessThan": "a287cd84e047045f5a4d4da793414e848de627c6",
              "status": "affected",
              "version": "a6088845c2bf754d6cb2572b484180680b037804",
              "versionType": "git"
            },
            {
              "lessThan": "2ef3c76540c49167a0bc3d5f80d00fd1fc4586df",
              "status": "affected",
              "version": "a6088845c2bf754d6cb2572b484180680b037804",
              "versionType": "git"
            },
            {
              "lessThan": "efed9a3337e341bd0989161b97453b52567bc59d",
              "status": "affected",
              "version": "a6088845c2bf754d6cb2572b484180680b037804",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/bfq-iosched.c",
            "block/blk-mq-sched.c",
            "block/kyber-iosched.c",
            "block/mq-deadline.c",
            "include/linux/elevator.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.120",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.38",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.22",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.5",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkyber: fix out of bounds access when preempted\n\n__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and\npasses the hctx to -\u003ebio_merge(). kyber_bio_merge() then gets the ctx\nfor the current CPU again and uses that to get the corresponding Kyber\ncontext in the passed hctx. However, the thread may be preempted between\nthe two calls to blk_mq_get_ctx(), and the ctx returned the second time\nmay no longer correspond to the passed hctx. This \"works\" accidentally\nmost of the time, but it can cause us to read garbage if the second ctx\ncame from an hctx with more ctx\u0027s than the first one (i.e., if\nctx-\u003eindex_hw[hctx-\u003etype] \u003e hctx-\u003enr_ctx).\n\nThis manifested as this UBSAN array index out of bounds error reported\nby Jakub:\n\nUBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9\nindex 13106 is out of range for type \u0027long unsigned int [128]\u0027\nCall Trace:\n dump_stack+0xa4/0xe5\n ubsan_epilogue+0x5/0x40\n __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34\n queued_spin_lock_slowpath+0x476/0x480\n do_raw_spin_lock+0x1c2/0x1d0\n kyber_bio_merge+0x112/0x180\n blk_mq_submit_bio+0x1f5/0x1100\n submit_bio_noacct+0x7b0/0x870\n submit_bio+0xc2/0x3a0\n btrfs_map_bio+0x4f0/0x9d0\n btrfs_submit_data_bio+0x24e/0x310\n submit_one_bio+0x7f/0xb0\n submit_extent_page+0xc4/0x440\n __extent_writepage_io+0x2b8/0x5e0\n __extent_writepage+0x28d/0x6e0\n extent_write_cache_pages+0x4d7/0x7a0\n extent_writepages+0xa2/0x110\n do_writepages+0x8f/0x180\n __writeback_single_inode+0x99/0x7f0\n writeback_sb_inodes+0x34e/0x790\n __writeback_inodes_wb+0x9e/0x120\n wb_writeback+0x4d2/0x660\n wb_workfn+0x64d/0xa10\n process_one_work+0x53a/0xa80\n worker_thread+0x69/0x5b0\n kthread+0x20b/0x240\n ret_from_fork+0x1f/0x30\n\nOnly Kyber uses the hctx, so fix it by passing the request_queue to\n-\u003ebio_merge() instead. BFQ and mq-deadline just use that, and Kyber can\nmap the queues itself to avoid the mismatch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is in the Kyber block I/O scheduler on the local bio submit path (write/read \u2192 submit_bio \u2192 blk_mq_submit_bio \u2192 kyber_bio_merge), so exploitation requires local process access to issue I/O, not a network protocol handler.\nAC:L - An attacker controls I/O submission and can amplify the CPU-migration race via affinity bouncing, concurrent writers, and load; the race has occurred under real I/O pressure, so success does not depend on conditions beyond attacker influence.\nPR:L - Any unprivileged local user who can read/write files on a device using Kyber reaches the vulnerable merge path with no capabilities required; selecting Kyber via sysfs needs root but is a deployment precondition, not an attacker privilege.\nUI:N - Exploitation only requires the attacker\u2019s own I/O syscalls; no separate victim action such as mounting a filesystem or opening a crafted file is needed.\nS:U - Impact is memory corruption within the host kernel\u2019s block layer and does not cross a VM, IOMMU, or other distinct security authority boundary.\nC:H - The OOB index reads an out-of-range kyber_ctx_queue (lock and list heads) from adjacent heap memory, and the subsequent list walk dereferences those attacker-influenceable request pointers, enabling arbitrary kernel memory disclosure.\nI:H - spin_lock on the OOB object writes a corrupted lock word, and blk_bio_list_merge can mutate poisoned list pointers, yielding classic linked-list memory corruption suitable for arbitrary write and control-flow hijacking.\nA:H - Locking and walking garbage kyber_ctx_queue state causes kernel oops/panic (as in the reported qspinlock UBSAN failure in kyber_bio_merge), so availability impact is complete."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:23.565Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b6b4b90b74c27bea968c214d820ba4254b903a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/54dbe2d2c1fcabf650c7a8b747601da355cd7f9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a287cd84e047045f5a4d4da793414e848de627c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ef3c76540c49167a0bc3d5f80d00fd1fc4586df"
        },
        {
          "url": "https://git.kernel.org/stable/c/efed9a3337e341bd0989161b97453b52567bc59d"
        }
      ],
      "title": "kyber: fix out of bounds access when preempted",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46984",
    "datePublished": "2024-02-28T08:13:12.835Z",
    "dateReserved": "2024-02-27T18:42:55.946Z",
    "dateUpdated": "2026-08-05T08:45:23.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0b6b4b90b74c27bea968c214d820ba4254b903a5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/54dbe2d2c1fcabf650c7a8b747601da355cd7f9f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a287cd84e047045f5a4d4da793414e848de627c6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2ef3c76540c49167a0bc3d5f80d00fd1fc4586df\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/efed9a3337e341bd0989161b97453b52567bc59d\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:37.898Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-46984\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:01:11.596982Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:18.080Z\"}}], \"cna\": {\"title\": \"kyber: fix out of bounds access when preempted\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is in the Kyber block I/O scheduler on the local bio submit path (write/read \\u2192 submit_bio \\u2192 blk_mq_submit_bio \\u2192 kyber_bio_merge), so exploitation requires local process access to issue I/O, not a network protocol handler.\\nAC:L - An attacker controls I/O submission and can amplify the CPU-migration race via affinity bouncing, concurrent writers, and load; the race has occurred under real I/O pressure, so success does not depend on conditions beyond attacker influence.\\nPR:L - Any unprivileged local user who can read/write files on a device using Kyber reaches the vulnerable merge path with no capabilities required; selecting Kyber via sysfs needs root but is a deployment precondition, not an attacker privilege.\\nUI:N - Exploitation only requires the attacker\\u2019s own I/O syscalls; no separate victim action such as mounting a filesystem or opening a crafted file is needed.\\nS:U - Impact is memory corruption within the host kernel\\u2019s block layer and does not cross a VM, IOMMU, or other distinct security authority boundary.\\nC:H - The OOB index reads an out-of-range kyber_ctx_queue (lock and list heads) from adjacent heap memory, and the subsequent list walk dereferences those attacker-influenceable request pointers, enabling arbitrary kernel memory disclosure.\\nI:H - spin_lock on the OOB object writes a corrupted lock word, and blk_bio_list_merge can mutate poisoned list pointers, yielding classic linked-list memory corruption suitable for arbitrary write and control-flow hijacking.\\nA:H - Locking and walking garbage kyber_ctx_queue state causes kernel oops/panic (as in the reported qspinlock UBSAN failure in kyber_bio_merge), so availability impact is complete.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a6088845c2bf754d6cb2572b484180680b037804\", \"lessThan\": \"0b6b4b90b74c27bea968c214d820ba4254b903a5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a6088845c2bf754d6cb2572b484180680b037804\", \"lessThan\": \"54dbe2d2c1fcabf650c7a8b747601da355cd7f9f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a6088845c2bf754d6cb2572b484180680b037804\", \"lessThan\": \"a287cd84e047045f5a4d4da793414e848de627c6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a6088845c2bf754d6cb2572b484180680b037804\", \"lessThan\": \"2ef3c76540c49167a0bc3d5f80d00fd1fc4586df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a6088845c2bf754d6cb2572b484180680b037804\", \"lessThan\": \"efed9a3337e341bd0989161b97453b52567bc59d\", \"versionType\": \"git\"}], \"programFiles\": [\"block/bfq-iosched.c\", \"block/blk-mq-sched.c\", \"block/kyber-iosched.c\", \"block/mq-deadline.c\", \"include/linux/elevator.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.38\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.11.22\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.11.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"block/bfq-iosched.c\", \"block/blk-mq-sched.c\", \"block/kyber-iosched.c\", \"block/mq-deadline.c\", \"include/linux/elevator.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0b6b4b90b74c27bea968c214d820ba4254b903a5\"}, {\"url\": \"https://git.kernel.org/stable/c/54dbe2d2c1fcabf650c7a8b747601da355cd7f9f\"}, {\"url\": \"https://git.kernel.org/stable/c/a287cd84e047045f5a4d4da793414e848de627c6\"}, {\"url\": \"https://git.kernel.org/stable/c/2ef3c76540c49167a0bc3d5f80d00fd1fc4586df\"}, {\"url\": \"https://git.kernel.org/stable/c/efed9a3337e341bd0989161b97453b52567bc59d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nkyber: fix out of bounds access when preempted\\n\\n__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and\\npasses the hctx to -\u003ebio_merge(). kyber_bio_merge() then gets the ctx\\nfor the current CPU again and uses that to get the corresponding Kyber\\ncontext in the passed hctx. However, the thread may be preempted between\\nthe two calls to blk_mq_get_ctx(), and the ctx returned the second time\\nmay no longer correspond to the passed hctx. This \\\"works\\\" accidentally\\nmost of the time, but it can cause us to read garbage if the second ctx\\ncame from an hctx with more ctx\u0027s than the first one (i.e., if\\nctx-\u003eindex_hw[hctx-\u003etype] \u003e hctx-\u003enr_ctx).\\n\\nThis manifested as this UBSAN array index out of bounds error reported\\nby Jakub:\\n\\nUBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9\\nindex 13106 is out of range for type \u0027long unsigned int [128]\u0027\\nCall Trace:\\n dump_stack+0xa4/0xe5\\n ubsan_epilogue+0x5/0x40\\n __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34\\n queued_spin_lock_slowpath+0x476/0x480\\n do_raw_spin_lock+0x1c2/0x1d0\\n kyber_bio_merge+0x112/0x180\\n blk_mq_submit_bio+0x1f5/0x1100\\n submit_bio_noacct+0x7b0/0x870\\n submit_bio+0xc2/0x3a0\\n btrfs_map_bio+0x4f0/0x9d0\\n btrfs_submit_data_bio+0x24e/0x310\\n submit_one_bio+0x7f/0xb0\\n submit_extent_page+0xc4/0x440\\n __extent_writepage_io+0x2b8/0x5e0\\n __extent_writepage+0x28d/0x6e0\\n extent_write_cache_pages+0x4d7/0x7a0\\n extent_writepages+0xa2/0x110\\n do_writepages+0x8f/0x180\\n __writeback_single_inode+0x99/0x7f0\\n writeback_sb_inodes+0x34e/0x790\\n __writeback_inodes_wb+0x9e/0x120\\n wb_writeback+0x4d2/0x660\\n wb_workfn+0x64d/0xa10\\n process_one_work+0x53a/0xa80\\n worker_thread+0x69/0x5b0\\n kthread+0x20b/0x240\\n ret_from_fork+0x1f/0x30\\n\\nOnly Kyber uses the hctx, so fix it by passing the request_queue to\\n-\u003ebio_merge() instead. BFQ and mq-deadline just use that, and Kyber can\\nmap the queues itself to avoid the mismatch.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.120\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.38\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.11.22\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.5\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"4.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:45:23.565Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-46984\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:45:23.565Z\", \"dateReserved\": \"2024-02-27T18:42:55.946Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-28T08:13:12.835Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.