CVE-2021-47461

userfaultfd: fix a race between writeprotect and exit_mmap()

State: Published
Severity: 7.8 High
Published: May 22, 2024
Updated: Aug 5, 2026
Reserved: May 22, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: fix a race between writeprotect and exit_mmap()

A race is possible when a process exits, its VMAs are removed by exit_mmap() and at the same time userfaultfd_writeprotect() is called.

The race was detected by KASAN on a development kernel, but it appears to be possible on vanilla kernels as well.

Use mmget_not_zero() to prevent the race as done in other userfaultfd operations.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 to before 3cda4bfffd4f755645577aaa9e96a606657b4525Affected 63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 to before 149958ecd0627a9f1e9c678c25c665400054cd6aAffected 63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 to before cb185d5f1ebf900f4ae3bf84cee212e6dd035acaAffected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.76 through 5.10.Not affected 5.14.15 through 5.14.Not affected 5.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.