CVE-2021-47646 Revert "Revert "block, bfq: honor already-setup queue merges""
A use-after-free vulnerability in the Linux kernel BFQ I/O scheduler can cause a system crash, requiring a kernel patch to resolve.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47646?
CVE-2021-47646 is a high-severity use after free vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Revert "Revert "block, bfq: honor already-setup queue merges""
A crash [1] happened to be triggered in conjunction with commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges"). The latter was then reverted by commit ebc69e897e17 ("Revert "block, bfq: honor already-setup queue merges""). Yet, the reverted commit was not the one introducing the bug. In fact, it actually triggered a UAF introduced by a different commit, and now fixed by commit d29bd41428cf ("block, bfq: reset last_bfqq_created on group change").
So, there is no point in keeping commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges") out. This commit restores it.
[1] https://bugzilla.kernel.org/show_bug.cgi?id=214503
Weakness: CWE-416
Which versions are affected by CVE-2021-47646?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47646?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2021-47646 being exploited?
There is no known exploitation of CVE-2021-47646 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47646, GHSA-8qgg-vj9j-hh4r, UBUNTU-CVE-2021-47646.