CVE-2021-47483

regmap: Fix possible double-free in regcache_rbtree_exit()

State: Published
Severity: 7.8 High
Published: May 22, 2024
Updated: Aug 5, 2026
Reserved: May 22, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

regmap: Fix possible double-free in regcache_rbtree_exit()

In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will be freed, so 'rbnode->block' points a freed memory, in the error handling path of regcache_rbtree_init(), 'rbnode->block' will be freed again in regcache_rbtree_exit(), KASAN will report double-free as follows:

BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 Call Trace: slab_free_freelist_hook+0x10d/0x240 kfree+0xce/0x390 regcache_rbtree_exit+0x15d/0x1a0 regcache_rbtree_init+0x224/0x2c0 regcache_init+0x88d/0x1310 __regmap_init+0x3151/0x4a80 __devm_regmap_init+0x7d/0x100 madera_spi_probe+0x10f/0x333 [madera_spi] spi_probe+0x183/0x210 really_probe+0x285/0xc30

To fix this, moving up the assignment of rbnode->block to immediately after the reallocation has succeeded so that the data structure stays valid even if the second reallocation fails.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before e72dce9afbdbfa70d9b44f5908a50ff6c4858999Affected 3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before fc081477b47dfc3a6cb50a96087fc29674013fc2Affected 3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 758ced2c3878ff789801e6fee808e185c5cf08d6Affected 3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 3dae1a4eced3ee733d7222e69b8a55caf2d61091Affected 3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 1cead23c1c0bc766dacb900a3b0269f651ad596fAffected 3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 36e911a16b377bde0ad91a8c679069d0d310b1a6Affected 3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 50cc1462a668dc62949a1127388bc3af785ce047Affected 3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 55e6d8037805b3400096d621091dfbf713f97e83Affected
LinuxLinux	3.12Affected before 3.12Not affected 4.4.291 through 4.4.Not affected 4.9.289 through 4.9.Not affected 4.14.254 through 4.14.Not affected 4.19.215 through 4.19.Not affected 5.4.157 through 5.4.Not affected 5.10.77 through 5.10.Not affected 5.14.16 through 5.14.*Not affected 5.15 and laterNot affected

Product

Versions

LinuxLinux

3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before e72dce9afbdbfa70d9b44f5908a50ff6c4858999Affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before fc081477b47dfc3a6cb50a96087fc29674013fc2Affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 758ced2c3878ff789801e6fee808e185c5cf08d6Affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 3dae1a4eced3ee733d7222e69b8a55caf2d61091Affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 1cead23c1c0bc766dacb900a3b0269f651ad596fAffected
3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 36e911a16b377bde0ad91a8c679069d0d310b1a6Affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 50cc1462a668dc62949a1127388bc3af785ce047Affected
3f4ff561bc88b074d5e868dde4012d89cbb06c87 to before 55e6d8037805b3400096d621091dfbf713f97e83Affected

LinuxLinux

3.12Affected
before 3.12Not affected
4.4.291 through 4.4.*Not affected
4.9.289 through 4.9.*Not affected
4.14.254 through 4.14.*Not affected
4.19.215 through 4.19.*Not affected
5.4.157 through 5.4.*Not affected
5.10.77 through 5.10.*Not affected
5.14.16 through 5.14.*Not affected
5.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.