GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47551 (GCVE-0-2021-47551)

Vulnerability from cvelistv5 – Published: 2024-05-24 15:09 – Updated: 2026-08-05 08:48
VLAI
Title
drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again In SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch already been called, the start_cpsch will not be called since there is no resume in this case. When reset been triggered again, driver should avoid to do uninitialization again.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-28 15:41 UTC
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2c99a547bcf9bb8532abd2953479949018449f93 , < 74aafe99efb68f15e50be9f7032c2168512f98a8 (git)
Affected: 2c99a547bcf9bb8532abd2953479949018449f93 , < 06c6f8f86ec243b89e52f0c3dc7062bcb9de74df (git)
Affected: 2c99a547bcf9bb8532abd2953479949018449f93 , < 2cf49e00d40d5132e3d067b5aa6d84791929ab15 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.84 , ≤ 5.10.* (semver)
Unaffected: 5.15.7 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
linux linux_kernel Unaffected: 0 , ≤ 5.16 (custom)
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Create a notification for this product.
linux linux_kernel Unaffected: 0 , ≤ 5.10.84 (custom)
    cpe:2.3:o:linux:linux_kernel:5.10.84:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.16",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.10.84:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.10.84",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47551",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T15:41:59.377852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:29:22.031Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.853Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "74aafe99efb68f15e50be9f7032c2168512f98a8",
              "status": "affected",
              "version": "2c99a547bcf9bb8532abd2953479949018449f93",
              "versionType": "git"
            },
            {
              "lessThan": "06c6f8f86ec243b89e52f0c3dc7062bcb9de74df",
              "status": "affected",
              "version": "2c99a547bcf9bb8532abd2953479949018449f93",
              "versionType": "git"
            },
            {
              "lessThan": "2cf49e00d40d5132e3d067b5aa6d84791929ab15",
              "status": "affected",
              "version": "2c99a547bcf9bb8532abd2953479949018449f93",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.84",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.7",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again\n\nIn SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch\nalready been called, the start_cpsch will not be called since there is no resume in this\ncase.  When reset been triggered again, driver should avoid to do uninitialization again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable stop_cpsch path is reached during GPU reset of an AMD KFD device (via /dev/kfd or DRM render-node workloads that hang the GPU), requiring local access to the compute/graphics device nodes rather than network packet processing.\nAC:L - An attacker who can submit GPU work can induce an HWS hang that schedules reset; in SRIOV, amdgpu_device_reset_sriov retries after failure and re-enters stop_cpsch without start_cpsch, so the double-uninit is reliably hit once a reset fails or is retried.\nPR:L - Triggering requires only unprivileged access to /dev/kfd or a DRM render node (typically render-group membership), not real root or init-namespace capabilities.\nUI:N - The attacker triggers GPU hang and subsequent reset through their own device ioctls; no separate victim action is required.\nS:U - The double-free and panic occur in the same kernel that hosts the amdkfd driver (including a guest with an SRIOV VF); this does not cross a VM/IOMMU security boundary into the host.\nC:H - stop_cpsch frees dqm-\u003efence_mem without NULLing it, so a second call is a use-after-free of the kfd_mem_obj; per UAF guidance this can be leveraged for arbitrary kernel read/disclosure primitives.\nI:H - The same dangling fence_mem leads to a double kfree and GTT SA bitmap corruption, and pm_uninit is invoked twice on a torn-down packet manager\u2014memory corruption consistent with write/control-flow hijack primitives.\nA:H - The second stop_cpsch causes kernel panic/oops via UAF/double-free and NULL dereference in kernel_queue_uninit(pm-\u003epriv_queue) after priv_queue was already set to NULL."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:20.962Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15"
        }
      ],
      "title": "drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47551",
    "datePublished": "2024-05-24T15:09:54.635Z",
    "dateReserved": "2024-05-24T15:02:54.832Z",
    "dateUpdated": "2026-08-05T08:48:20.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47551",
      "date": "2026-09-15",
      "epss": "0.00287",
      "percentile": "0.2121"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again\\n\\nIn SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch\\nalready been called, the start_cpsch will not be called since there is no resume in this\\ncase.  When reset been triggered again, driver should avoid to do uninitialization again.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: drm/amd/amdkfd: corrige el p\\u00e1nico del kernel cuando el reinicio falla y se activa nuevamente. En la configuraci\\u00f3n SRIOV, el reinicio puede no lograr que asic vuelva a la normalidad, pero ya se ha llamado a detener cpsch, el No se llamar\\u00e1 a start_cpsch ya que en este caso no hay ning\\u00fan curr\\u00edculum. Cuando el reinicio se activa nuevamente, el controlador debe evitar realizar la desinicializaci\\u00f3n nuevamente.\"}]",
      "id": "CVE-2021-47551",
      "lastModified": "2024-11-21T06:36:31.810",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.0, \"impactScore\": 4.0}]}",
      "published": "2024-05-24T15:15:19.927",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47551\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-24T15:15:19.927\",\"lastModified\":\"2026-08-04T10:17:08.283\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again\\n\\nIn SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch\\nalready been called, the start_cpsch will not be called since there is no resume in this\\ncase.  When reset been triggered again, driver should avoid to do uninitialization again.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/amd/amdkfd: corrige el p\u00e1nico del kernel cuando el reinicio falla y se activa nuevamente. En la configuraci\u00f3n SRIOV, el reinicio puede no lograr que asic vuelva a la normalidad, pero ya se ha llamado a detener cpsch, el No se llamar\u00e1 a start_cpsch ya que en este caso no hay ning\u00fan curr\u00edculum. Cuando el reinicio se activa nuevamente, el controlador debe evitar realizar la desinicializaci\u00f3n nuevamente.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2c99a547bcf9bb8532abd2953479949018449f93\",\"lessThan\":\"74aafe99efb68f15e50be9f7032c2168512f98a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c99a547bcf9bb8532abd2953479949018449f93\",\"lessThan\":\"06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c99a547bcf9bb8532abd2953479949018449f93\",\"lessThan\":\"2cf49e00d40d5132e3d067b5aa6d84791929ab15\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.84\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.7\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"5.16\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:5.10.84:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"5.10.84\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-28T15:41:59.377852Z\",\"id\":\"CVE-2021-47551\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.84\",\"matchCriteriaId\":\"2771BC87-698A-4F2C-B04F-D8D773D4EA58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.7\",\"matchCriteriaId\":\"A696A60B-2782-4119-83DD-1EFFBC903F02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:56:59+00:00",
      "cve": "CVE-2021-47551",
      "id": "CVE-2021-47551",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47551.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T00:58:03Z",
      "cve": "CVE-2021-47551",
      "id": "CVE-2021-47551",
      "initial_release_date": "2024-05-28T15:29:27Z",
      "product_status:known_affected": "307",
      "product_status:known_not_affected": "181",
      "product_status:recommended": "452",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47551",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47551.json",
      "version": "61"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.853Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47551\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-28T15:41:59.377852Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.16\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:5.10.84:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.10.84\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-28T15:50:17.589Z\"}}], \"cna\": {\"title\": \"drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable stop_cpsch path is reached during GPU reset of an AMD KFD device (via /dev/kfd or DRM render-node workloads that hang the GPU), requiring local access to the compute/graphics device nodes rather than network packet processing.\\nAC:L - An attacker who can submit GPU work can induce an HWS hang that schedules reset; in SRIOV, amdgpu_device_reset_sriov retries after failure and re-enters stop_cpsch without start_cpsch, so the double-uninit is reliably hit once a reset fails or is retried.\\nPR:L - Triggering requires only unprivileged access to /dev/kfd or a DRM render node (typically render-group membership), not real root or init-namespace capabilities.\\nUI:N - The attacker triggers GPU hang and subsequent reset through their own device ioctls; no separate victim action is required.\\nS:U - The double-free and panic occur in the same kernel that hosts the amdkfd driver (including a guest with an SRIOV VF); this does not cross a VM/IOMMU security boundary into the host.\\nC:H - stop_cpsch frees dqm-\u003efence_mem without NULLing it, so a second call is a use-after-free of the kfd_mem_obj; per UAF guidance this can be leveraged for arbitrary kernel read/disclosure primitives.\\nI:H - The same dangling fence_mem leads to a double kfree and GTT SA bitmap corruption, and pm_uninit is invoked twice on a torn-down packet manager\\u2014memory corruption consistent with write/control-flow hijack primitives.\\nA:H - The second stop_cpsch causes kernel panic/oops via UAF/double-free and NULL dereference in kernel_queue_uninit(pm-\u003epriv_queue) after priv_queue was already set to NULL.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2c99a547bcf9bb8532abd2953479949018449f93\", \"lessThan\": \"74aafe99efb68f15e50be9f7032c2168512f98a8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c99a547bcf9bb8532abd2953479949018449f93\", \"lessThan\": \"06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c99a547bcf9bb8532abd2953479949018449f93\", \"lessThan\": \"2cf49e00d40d5132e3d067b5aa6d84791929ab15\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8\"}, {\"url\": \"https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\"}, {\"url\": \"https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again\\n\\nIn SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch\\nalready been called, the start_cpsch will not be called since there is no resume in this\\ncase.  When reset been triggered again, driver should avoid to do uninitialization again.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.84\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.7\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:20.962Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47551\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:20.962Z\", \"dateReserved\": \"2024-05-24T15:02:54.832Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-24T15:09:54.635Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.