GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47639 (GCVE-0-2021-47639)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2026-08-05 08:48
VLAI
Title
KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU Zap both valid and invalid roots when zapping/unmapping a gfn range, as KVM must ensure it holds no references to the freed page after returning from the unmap operation. Most notably, the TDP MMU doesn't zap invalid roots in mmu_notifier callbacks. This leads to use-after-free and other issues if the mmu_notifier runs to completion while an invalid root zapper yields as KVM fails to honor the requirement that there must be _no_ references to the page after the mmu_notifier returns. The bug is most easily reproduced by hacking KVM to cause a collision between set_nx_huge_pages() and kvm_mmu_notifier_release(), but the bug exists between kvm_mmu_notifier_invalidate_range_start() and memslot updates as well. Invalidating a root ensures pages aren't accessible by the guest, and KVM won't read or write page data itself, but KVM will trigger e.g. kvm_set_pfn_dirty() when zapping SPTEs, and thus completing a zap of an invalid root _after_ the mmu_notifier returns is fatal. WARNING: CPU: 24 PID: 1496 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm] RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm] Call Trace: <TASK> kvm_set_pfn_dirty+0xa8/0xe0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] zap_gfn_range+0x1f3/0x310 [kvm] kvm_tdp_mmu_zap_invalidated_roots+0x50/0x90 [kvm] kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm] set_nx_huge_pages+0xb4/0x190 [kvm] param_attr_store+0x70/0x100 module_attr_store+0x19/0x30 kernfs_fop_write_iter+0x119/0x1b0 new_sync_write+0x11c/0x1b0 vfs_write+0x1cc/0x270 ksys_write+0x5f/0xe0 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK>
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 18:17 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b7cccd397f310739fb85383033e95580f99927e0 , < af47248407c0c5ae52a752af1ab5ce5b0db91502 (git)
Affected: b7cccd397f310739fb85383033e95580f99927e0 , < 0c8a8da182d4333d9bbb9131d765145568c847b2 (git)
Affected: b7cccd397f310739fb85383033e95580f99927e0 , < 8cf6f98ab1d16d5e607635a0c21c4231eb15367e (git)
Affected: b7cccd397f310739fb85383033e95580f99927e0 , < d62007edf01f5c11f75d0f4b1e538fc52a5b1982 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47639",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:17:52.744634Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:35.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/tdp_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af47248407c0c5ae52a752af1ab5ce5b0db91502",
              "status": "affected",
              "version": "b7cccd397f310739fb85383033e95580f99927e0",
              "versionType": "git"
            },
            {
              "lessThan": "0c8a8da182d4333d9bbb9131d765145568c847b2",
              "status": "affected",
              "version": "b7cccd397f310739fb85383033e95580f99927e0",
              "versionType": "git"
            },
            {
              "lessThan": "8cf6f98ab1d16d5e607635a0c21c4231eb15367e",
              "status": "affected",
              "version": "b7cccd397f310739fb85383033e95580f99927e0",
              "versionType": "git"
            },
            {
              "lessThan": "d62007edf01f5c11f75d0f4b1e538fc52a5b1982",
              "status": "affected",
              "version": "b7cccd397f310739fb85383033e95580f99927e0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/tdp_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU\n\nZap both valid and invalid roots when zapping/unmapping a gfn range, as\nKVM must ensure it holds no references to the freed page after returning\nfrom the unmap operation.  Most notably, the TDP MMU doesn\u0027t zap invalid\nroots in mmu_notifier callbacks.  This leads to use-after-free and other\nissues if the mmu_notifier runs to completion while an invalid root\nzapper yields as KVM fails to honor the requirement that there must be\n_no_ references to the page after the mmu_notifier returns.\n\nThe bug is most easily reproduced by hacking KVM to cause a collision\nbetween set_nx_huge_pages() and kvm_mmu_notifier_release(), but the bug\nexists between kvm_mmu_notifier_invalidate_range_start() and memslot\nupdates as well.  Invalidating a root ensures pages aren\u0027t accessible by\nthe guest, and KVM won\u0027t read or write page data itself, but KVM will\ntrigger e.g. kvm_set_pfn_dirty() when zapping SPTEs, and thus completing\na zap of an invalid root _after_ the mmu_notifier returns is fatal.\n\n  WARNING: CPU: 24 PID: 1496 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm]\n  RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_set_pfn_dirty+0xa8/0xe0 [kvm]\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\n   zap_gfn_range+0x1f3/0x310 [kvm]\n   kvm_tdp_mmu_zap_invalidated_roots+0x50/0x90 [kvm]\n   kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm]\n   set_nx_huge_pages+0xb4/0x190 [kvm]\n   param_attr_store+0x70/0x100\n   module_attr_store+0x19/0x30\n   kernfs_fop_write_iter+0x119/0x1b0\n   new_sync_write+0x11c/0x1b0\n   vfs_write+0x1cc/0x270\n   ksys_write+0x5f/0xe0\n   do_syscall_64+0x38/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n   \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to /dev/kvm to create a VM and issue memslot updates (KVM_SET_USER_MEMORY_REGION) while concurrently unmapping guest backing memory; it is not reachable via network packets or pure guest execution without host VMM control.\nAC:L - The attacker controls both sides of the race\u2014memslot delete/move triggering kvm_mmu_zap_all_fast (which yields in kvm_tdp_mmu_zap_invalidated_roots) and munmap/madvise triggering mmu_notifier_invalidate_range_start\u2014so the race can be induced reliably without depending on external conditions.\nPR:L - Triggering requires only an unprivileged local account able to open /dev/kvm (e.g., kvm-group membership or nested-virt deployments), not real root/CAP_SYS_ADMIN in the init namespace.\nUI:N - The attacker directly drives the ioctls and memory unmap operations; no separate victim user action is required.\nS:U - This is a host userspace-to-host-kernel privilege escalation via KVM ioctls, not a guest-to-host escape; the impact remains within the host kernel\u2019s security authority.\nC:H - The bug is a use-after-free on host page/SPTE state (kvm_set_pfn_dirty on PFNs after mmu_notifier completion), which can be leveraged for arbitrary kernel memory disclosure via heap reuse.\nI:H - The same UAF on freed page structures during delayed invalid-root zapping provides a path to arbitrary kernel writes and control-flow hijacking once the freed memory is reallocated.\nA:H - The UAF reliably produces kernel WARN/oops paths (e.g., kvm_is_zone_device_pfn on pages with zero refcount) and can crash or hang the host even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:44.903Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af47248407c0c5ae52a752af1ab5ce5b0db91502"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c8a8da182d4333d9bbb9131d765145568c847b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cf6f98ab1d16d5e607635a0c21c4231eb15367e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d62007edf01f5c11f75d0f4b1e538fc52a5b1982"
        }
      ],
      "title": "KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47639",
    "datePublished": "2025-02-26T01:54:11.651Z",
    "dateReserved": "2025-02-26T01:48:21.519Z",
    "dateUpdated": "2026-08-05T08:48:44.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47639",
      "date": "2026-09-13",
      "epss": "0.00247",
      "percentile": "0.16065"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47639\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T06:37:05.677\",\"lastModified\":\"2026-06-17T04:18:13.050\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU\\n\\nZap both valid and invalid roots when zapping/unmapping a gfn range, as\\nKVM must ensure it holds no references to the freed page after returning\\nfrom the unmap operation.  Most notably, the TDP MMU doesn\u0027t zap invalid\\nroots in mmu_notifier callbacks.  This leads to use-after-free and other\\nissues if the mmu_notifier runs to completion while an invalid root\\nzapper yields as KVM fails to honor the requirement that there must be\\n_no_ references to the page after the mmu_notifier returns.\\n\\nThe bug is most easily reproduced by hacking KVM to cause a collision\\nbetween set_nx_huge_pages() and kvm_mmu_notifier_release(), but the bug\\nexists between kvm_mmu_notifier_invalidate_range_start() and memslot\\nupdates as well.  Invalidating a root ensures pages aren\u0027t accessible by\\nthe guest, and KVM won\u0027t read or write page data itself, but KVM will\\ntrigger e.g. kvm_set_pfn_dirty() when zapping SPTEs, and thus completing\\na zap of an invalid root _after_ the mmu_notifier returns is fatal.\\n\\n  WARNING: CPU: 24 PID: 1496 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm]\\n  RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   kvm_set_pfn_dirty+0xa8/0xe0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   zap_gfn_range+0x1f3/0x310 [kvm]\\n   kvm_tdp_mmu_zap_invalidated_roots+0x50/0x90 [kvm]\\n   kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm]\\n   set_nx_huge_pages+0xb4/0x190 [kvm]\\n   param_attr_store+0x70/0x100\\n   module_attr_store+0x19/0x30\\n   kernfs_fop_write_iter+0x119/0x1b0\\n   new_sync_write+0x11c/0x1b0\\n   vfs_write+0x1cc/0x270\\n   ksys_write+0x5f/0xe0\\n   do_syscall_64+0x38/0xc0\\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\\n   \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86/mmu: Se eliminan _todos_ las ra\u00edces al anular la asignaci\u00f3n del rango gfn en TDP MMU Se eliminan las ra\u00edces v\u00e1lidas e inv\u00e1lidas al hacer zapping/anular la asignaci\u00f3n de un rango gfn, ya que KVM debe asegurarse de que no contiene referencias a la p\u00e1gina liberada despu\u00e9s de regresar de la operaci\u00f3n de anulaci\u00f3n de la asignaci\u00f3n. En particular, TDP MMU no elimina las ra\u00edces inv\u00e1lidas en las devoluciones de llamadas mmu_notifier. Esto conduce a problemas de use-after-free y otros problemas si mmu_notifier se ejecuta hasta el final mientras que un zapper de ra\u00edz inv\u00e1lida cede, ya que KVM no cumple con el requisito de que no debe haber _ninguna_ referencia a la p\u00e1gina despu\u00e9s de que mmu_notifier regrese. El error se reproduce m\u00e1s f\u00e1cilmente pirateando KVM para provocar una colisi\u00f3n entre set_nx_huge_pages() y kvm_mmu_notifier_release(), pero el error tambi\u00e9n existe entre kvm_mmu_notifier_invalidate_range_start() y las actualizaciones de memslot. Invalidar una ra\u00edz garantiza que el invitado no pueda acceder a las p\u00e1ginas, y KVM no leer\u00e1 ni escribir\u00e1 datos de p\u00e1gina por s\u00ed mismo, pero KVM activar\u00e1, por ejemplo, kvm_set_pfn_dirty() al hacer zapping de SPTE, y por lo tanto, completar un zapping de una ra\u00edz no v\u00e1lida _despu\u00e9s_ de que mmu_notifier regrese es fatal. ADVERTENCIA: CPU: 24 PID: 1496 en arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm] RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm] Rastreo de llamadas:  kvm_set_pfn_dirty+0xa8/0xe0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] zap_gfn_range+0x1f3/0x310 [kvm] kvm_tdp_mmu_zap_ra\u00edces_invalidadas+0x50/0x90 [kvm] kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm] set_nx_huge_pages+0xb4/0x190 [kvm] param_attr_store+0x70/0x100 module_attr_store+0x19/0x30 kernfs_fop_write_iter+0x119/0x1b0 new_sync_write+0x11c/0x1b0 vfs_write+0x1cc/0x270 ksys_write+0x5f/0xe0 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/mmu/tdp_mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b7cccd397f310739fb85383033e95580f99927e0\",\"lessThan\":\"af47248407c0c5ae52a752af1ab5ce5b0db91502\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7cccd397f310739fb85383033e95580f99927e0\",\"lessThan\":\"0c8a8da182d4333d9bbb9131d765145568c847b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7cccd397f310739fb85383033e95580f99927e0\",\"lessThan\":\"8cf6f98ab1d16d5e607635a0c21c4231eb15367e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7cccd397f310739fb85383033e95580f99927e0\",\"lessThan\":\"d62007edf01f5c11f75d0f4b1e538fc52a5b1982\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/mmu/tdp_mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.33\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.19\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.2\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T18:17:52.744634Z\",\"id\":\"CVE-2021-47639\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"5.15.33\",\"matchCriteriaId\":\"3635E21D-6C8E-41E4-BF98-89A503BAF23D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.2\",\"matchCriteriaId\":\"210C679C-CF84-44A3-8939-E629C87E54BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c8a8da182d4333d9bbb9131d765145568c847b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8cf6f98ab1d16d5e607635a0c21c4231eb15367e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af47248407c0c5ae52a752af1ab5ce5b0db91502\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d62007edf01f5c11f75d0f4b1e538fc52a5b1982\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:38:43+00:00",
      "cve": "CVE-2021-47639",
      "id": "CVE-2021-47639",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:fixed": "286",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47639.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:35:23Z",
      "cve": "CVE-2021-47639",
      "id": "CVE-2021-47639",
      "initial_release_date": "2025-02-27T03:14:24Z",
      "product_status:known_affected": "334",
      "product_status:known_not_affected": "401",
      "product_status:recommended": "265",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47639",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47639.json",
      "version": "41"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47639\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:17:52.744634Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:17:54.139Z\"}}], \"cna\": {\"title\": \"KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Exploitation requires local access to /dev/kvm to create a VM and issue memslot updates (KVM_SET_USER_MEMORY_REGION) while concurrently unmapping guest backing memory; it is not reachable via network packets or pure guest execution without host VMM control.\\nAC:L - The attacker controls both sides of the race\\u2014memslot delete/move triggering kvm_mmu_zap_all_fast (which yields in kvm_tdp_mmu_zap_invalidated_roots) and munmap/madvise triggering mmu_notifier_invalidate_range_start\\u2014so the race can be induced reliably without depending on external conditions.\\nPR:L - Triggering requires only an unprivileged local account able to open /dev/kvm (e.g., kvm-group membership or nested-virt deployments), not real root/CAP_SYS_ADMIN in the init namespace.\\nUI:N - The attacker directly drives the ioctls and memory unmap operations; no separate victim user action is required.\\nS:U - This is a host userspace-to-host-kernel privilege escalation via KVM ioctls, not a guest-to-host escape; the impact remains within the host kernel\\u2019s security authority.\\nC:H - The bug is a use-after-free on host page/SPTE state (kvm_set_pfn_dirty on PFNs after mmu_notifier completion), which can be leveraged for arbitrary kernel memory disclosure via heap reuse.\\nI:H - The same UAF on freed page structures during delayed invalid-root zapping provides a path to arbitrary kernel writes and control-flow hijacking once the freed memory is reallocated.\\nA:H - The UAF reliably produces kernel WARN/oops paths (e.g., kvm_is_zone_device_pfn on pages with zero refcount) and can crash or hang the host even when not fully exploited.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b7cccd397f310739fb85383033e95580f99927e0\", \"lessThan\": \"af47248407c0c5ae52a752af1ab5ce5b0db91502\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b7cccd397f310739fb85383033e95580f99927e0\", \"lessThan\": \"0c8a8da182d4333d9bbb9131d765145568c847b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b7cccd397f310739fb85383033e95580f99927e0\", \"lessThan\": \"8cf6f98ab1d16d5e607635a0c21c4231eb15367e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b7cccd397f310739fb85383033e95580f99927e0\", \"lessThan\": \"d62007edf01f5c11f75d0f4b1e538fc52a5b1982\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/kvm/mmu/tdp_mmu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/kvm/mmu/tdp_mmu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/af47248407c0c5ae52a752af1ab5ce5b0db91502\"}, {\"url\": \"https://git.kernel.org/stable/c/0c8a8da182d4333d9bbb9131d765145568c847b2\"}, {\"url\": \"https://git.kernel.org/stable/c/8cf6f98ab1d16d5e607635a0c21c4231eb15367e\"}, {\"url\": \"https://git.kernel.org/stable/c/d62007edf01f5c11f75d0f4b1e538fc52a5b1982\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU\\n\\nZap both valid and invalid roots when zapping/unmapping a gfn range, as\\nKVM must ensure it holds no references to the freed page after returning\\nfrom the unmap operation.  Most notably, the TDP MMU doesn\u0027t zap invalid\\nroots in mmu_notifier callbacks.  This leads to use-after-free and other\\nissues if the mmu_notifier runs to completion while an invalid root\\nzapper yields as KVM fails to honor the requirement that there must be\\n_no_ references to the page after the mmu_notifier returns.\\n\\nThe bug is most easily reproduced by hacking KVM to cause a collision\\nbetween set_nx_huge_pages() and kvm_mmu_notifier_release(), but the bug\\nexists between kvm_mmu_notifier_invalidate_range_start() and memslot\\nupdates as well.  Invalidating a root ensures pages aren\u0027t accessible by\\nthe guest, and KVM won\u0027t read or write page data itself, but KVM will\\ntrigger e.g. kvm_set_pfn_dirty() when zapping SPTEs, and thus completing\\na zap of an invalid root _after_ the mmu_notifier returns is fatal.\\n\\n  WARNING: CPU: 24 PID: 1496 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm]\\n  RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   kvm_set_pfn_dirty+0xa8/0xe0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   zap_gfn_range+0x1f3/0x310 [kvm]\\n   kvm_tdp_mmu_zap_invalidated_roots+0x50/0x90 [kvm]\\n   kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm]\\n   set_nx_huge_pages+0xb4/0x190 [kvm]\\n   param_attr_store+0x70/0x100\\n   module_attr_store+0x19/0x30\\n   kernfs_fop_write_iter+0x119/0x1b0\\n   new_sync_write+0x11c/0x1b0\\n   vfs_write+0x1cc/0x270\\n   ksys_write+0x5f/0xe0\\n   do_syscall_64+0x38/0xc0\\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\\n   \u003c/TASK\u003e\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.33\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.19\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.2\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"5.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:44.903Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47639\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:44.903Z\", \"dateReserved\": \"2025-02-26T01:48:21.519Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:54:11.651Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}