CVE-2021-47254

gfs2: Fix use-after-free in gfs2_glock_shrink_scan

HIGH
7.8
CVSS Score
Published: May 21, 2024 at 02:19 PM UTC
Updated: August 5, 2026 at 09:24 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in gfs2_glock_shrink_scan The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to remove the glock from the lru list in __gfs2_glock_put(). On the shrink scan path, the same flag is cleared under lru_lock but because of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the put side can be made without deleting the glock from the lru list. Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to ensure correct behavior on both sides - clear GLF_LRU after list_del under lru_lock.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≥ 5.0.20v ≥ 5.1.64.14.123 ≤ v < 4.14.2384.19.47 ≤ v < 4.19.1964.4.181 ≤ v < 4.4.2744.9.180 ≤ v < 4.9.2745.0.20 ≤ v < 5.15.1.6 ≤ v < 5.25.1.6 ≤ v < 5.4.1275.11 ≤ v < 5.12.125.2 ≤ v < 5.10.455.2 ≤ v < 5.12.125.2 ≤ v < 5.135.2 ≤ v < 5.4.1275.5 ≤ v < 5.10.451e7a416fb765c9072479dc424780c0937ba992704.14.1234.19.474.4.1814.9.1805.0.205.1.65.13 rc15.13 rc25.13 rc35.13 rc46948c6bc17d666663a84c124b3176039e64a58f4762bb3528249604bc680a9df635e8995740176de7881ef3f33bb80f459ea6020d1e021fc524a6348b568ed385a18c0ddbe41862b69088b636550a04fbac8520892812dada1ac93f27d96317470d24b1fdcbdbe13796ffa561510d2686a6318564e728bbd
Vendor states this is fixed in 0364742decb0f02bc183404868b82896f7992595 (fixed)
Vendor states this is fixed in 094bf5670e762afa243d2c41a5c4ab71c7447bf4 (fixed)
Vendor states this is fixed in 1ab19c5de4c537ec0d9b21020395a5b5a6c059b2 (fixed)
Vendor states this is fixed in 38ce329534500bf4ae71f81df6a37a406cf187b4 (fixed)
Vendor states this is fixed in 86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d (fixed)
Vendor states this is fixed in 92869945cc5b78ee8a1ef90336fe070893e3458a (fixed)
Vendor states this is fixed in a61156314b66456ab6a291ed5deba1ebd002ab3c (fixed)
Vendor states this is fixed in e87ef30fe73e7e10d2c85bdcc778dcec24dca553 (fixed)
Vendor states this is fixed in 4.14.238 (unaffected)
Vendor states this is fixed in 4.19.196 (unaffected)
Vendor states this is fixed in 4.4.274 (unaffected)
Vendor states this is fixed in 4.9.274 (unaffected)
Affected range stops below 5.1, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.10.45 (unaffected)
Vendor states this is fixed in 5.12.12 (unaffected)
Vendor states this is fixed in 5.13 (unaffected)
Vendor states this is fixed in 5.2 (unaffected)
Vendor states this is fixed in 5.4.127 (unaffected)

References (8)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card