{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-47510 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2021-47510 is a medium-severity denial of service vulnerability in Linux kernel, published on 24 May 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-47510 and fix it if it is affected.\n\nWhat it is: CVE-2021-47510 is a medium-severity denial of service vulnerability in Linux kernel, published on 24 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-47510 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-47510/ (Markdown: https://insights.sbomify.com/CVE-2021-47510/index.md)","id":"CVE-2021-47510","markdown":"https://insights.sbomify.com/CVE-2021-47510/index.md","name":"CVE-2021-47510","record":{"aliases":["DEBIAN-CVE-2021-47510","UBUNTU-CVE-2021-47510"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A flaw in the Linux kernel's btrfs file system can cause a transaction abort and force the filesystem to read-only, leading to denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix re-dirty process of tree-log nodes\n\nThere is a report of a transaction abort of -EAGAIN with the following\nscript.\n\n  #!/bin/sh\n\n  for d in sda sdb; do\n          mkfs.btrfs -d single -m single -f /dev/\\${d}\n  done\n\n  mount /dev/sda /mnt/test\n  mount /dev/sdb /mnt/scratch\n\n  for dir in test scratch; do\n          echo 3 \u003e/proc/sys/vm/drop_caches\n          fio --directory=/mnt/\\${dir} --name=fio.\\${dir} --rw=read --size=50G --bs=64m \\\n                  --numjobs=$(nproc) --time_based --ramp_time=5 --runtime=480 \\\n                  --group_reporting |\u0026 tee /dev/shm/fio.\\${dir}\n          echo 3 \u003e/proc/sys/vm/drop_caches\n  done\n\n  for d in sda sdb; do\n          umount /dev/\\${d}\n  done\n\nThe stack trace is shown in below.\n\n  [3310.967991] BTRFS: error (device sda) in btrfs_commit_transaction:2341: errno=-11 unknown (Error while writing out transaction)\n  [3310.968060] BTRFS info (device sda): forced readonly\n  [3310.968064] BTRFS warning (device sda): Skipping commit of aborted transaction.\n  [3310.968065] ------------[ cut here ]------------\n  [3310.968066] BTRFS: Transaction aborted (error -11)\n  [3310.968074] WARNING: CPU: 14 PID: 1684 at fs/btrfs/transaction.c:1946 btrfs_commit_transaction.cold+0x209/0x2c8\n  [3310.968131] CPU: 14 PID: 1684 Comm: fio Not tainted 5.14.10-300.fc35.x86_64 #1\n  [3310.968135] Hardware name: DIAWAY Tartu/Tartu, BIOS V2.01.B10 04/08/2021\n  [3310.968137] RIP: 0010:btrfs_commit_transaction.cold+0x209/0x2c8\n  [3310.968144] RSP: 0018:ffffb284ce393e10 EFLAGS: 00010282\n  [3310.968147] RAX: 0000000000000026 RBX: ffff973f147b0f60 RCX: 0000000000000027\n  [3310.968149] RDX: ffff974ecf098a08 RSI: 0000000000000001 RDI: ffff974ecf098a00\n  [3310.968150] RBP: ffff973f147b0f08 R08: 0000000000000000 R09: ffffb284ce393c48\n  [3310.968151] R10: ffffb284ce393c40 R11: ffffffff84f47468 R12: ffff973f101bfc00\n  [3310.968153] R13: ffff971f20cf2000 R14: 00000000fffffff5 R15: ffff973f147b0e58\n  [3310.968154] FS:  00007efe65468740(0000) GS:ffff974ecf080000(0000) knlGS:0000000000000000\n  [3310.968157] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [3310.968158] CR2: 000055691bcbe260 CR3: 000000105cfa4001 CR4: 0000000000770ee0\n  [3310.968160] PKRU: 55555554\n  [3310.968161] Call Trace:\n  [3310.968167]  ? dput+0xd4/0x300\n  [3310.968174]  btrfs_sync_file+0x3f1/0x490\n  [3310.968180]  __x64_sys_fsync+0x33/0x60\n  [3310.968185]  do_syscall_64+0x3b/0x90\n  [3310.968190]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n  [3310.968194] RIP: 0033:0x7efe6557329b\n  [3310.968200] RSP: 002b:00007ffe0236ebc0 EFLAGS: 00000293 ORIG_RAX: 000000000000004a\n  [3310.968203] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efe6557329b\n  [3310.968204] RDX: 0000000000000000 RSI: 00007efe58d77010 RDI: 0000000000000006\n  [3310.968205] RBP: 0000000004000000 R08: 0000000000000000 R09: 00007efe58d77010\n  [3310.968207] R10: 0000000016cacc0c R11: 0000000000000293 R12: 00007efe5ce95980\n  [3310.968208] R13: 0000000000000000 R14: 00007efe6447c790 R15: 0000000c80000000\n  [3310.968212] ---[ end trace 1a346f4d3c0d96ba ]---\n  [3310.968214] BTRFS: error (device sda) in cleanup_transaction:1946: errno=-11 unknown\n\nThe abort occurs because of a write hole while writing out freeing tree\nnodes of a tree-log tree. For zoned btrfs, we re-dirty a freed tree\nnode to ensure btrfs can write the region and does not leave a hole on\nwrite on a zoned device. The current code fails to re-dirty a node\nwhen the tree-log tree's depth is greater or equal to 2. That leads to\na transaction abort with -EAGAIN.\n\nFix the issue by properly re-dirtying a node on walking up the tree.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"btrfs: fix re-dirty process of tree-log nodes","id":"CVE-2021-47510","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2021"},"n_packages":0,"n_references":2,"next":{"headline":"ALSA: pcm: oss: Fix negative period/buffer sizes","id":"CVE-2021-47511"},"packages":[],"prev":{"headline":"ALSA: pcm: oss: Limit the period size to 16MB","id":"CVE-2021-47509"},"products":["Linux"],"published":"2024-05-24","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A flaw in the Linux kernel's btrfs file system can cause a transaction abort and force the filesystem to read-only, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2021-47510/"}