GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47421 (GCVE-0-2021-47421)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:04 – Updated: 2026-08-05 08:47
VLAI
Title
drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock. To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:37 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c9a6b82f45e261d247b980a7949aaa6a9bfffe01 , < 785cc093b6b5a93cc350421a55f3f1eda6585156 (git)
Affected: c9a6b82f45e261d247b980a7949aaa6a9bfffe01 , < 72e9a1bf9b722628c28092e0c2cd8717edd201dc (git)
Affected: c9a6b82f45e261d247b980a7949aaa6a9bfffe01 , < 248b061689a40f4fed05252ee2c89f87cf26d7d8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.14.12 , ≤ 5.14.* (semver)
Unaffected: 5.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:30:56.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/72e9a1bf9b722628c28092e0c2cd8717edd201dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/248b061689a40f4fed05252ee2c89f87cf26d7d8"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47421",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:37:47.598437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:56.726Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu.h",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "785cc093b6b5a93cc350421a55f3f1eda6585156",
              "status": "affected",
              "version": "c9a6b82f45e261d247b980a7949aaa6a9bfffe01",
              "versionType": "git"
            },
            {
              "lessThan": "72e9a1bf9b722628c28092e0c2cd8717edd201dc",
              "status": "affected",
              "version": "c9a6b82f45e261d247b980a7949aaa6a9bfffe01",
              "versionType": "git"
            },
            {
              "lessThan": "248b061689a40f4fed05252ee2c89f87cf26d7d8",
              "status": "affected",
              "version": "c9a6b82f45e261d247b980a7949aaa6a9bfffe01",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu.h",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.12",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume\n\nIn current code, when a PCI error state pci_channel_io_normal is detectd,\nit will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI\ndriver will continue the execution of PCI resume callback report_resume by\npci_walk_bridge, and the callback will go into amdgpu_pci_resume\nfinally, where write lock is releasd unconditionally without acquiring\nsuch lock first. In this case, a deadlock will happen when other threads\nstart to acquire the read lock.\n\nTo fix this, add a member in amdgpu_device strucutre to cache\npci_channel_state, and only continue the execution in amdgpu_pci_resume\nwhen it\u0027s pci_channel_io_frozen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable amdgpu PCI ERS callbacks are reached only from local PCIe AER non-fatal recovery on the AMD GPU (or local aer_inject), not from network packet processing or adjacent-link protocols.\nAC:L - Once a non-fatal AER recovery runs, amdgpu_pci_resume deterministically unlocks without locking and operates on live schedulers; an attacker who can induce AER via GPU work can retry until in-flight jobs make the corruption path hit, with no luck-based race beyond their control.\nPR:L - An unprivileged local user with DRM render-node access (/dev/dri/renderD*, DRM_RENDER_ALLOW ioctls) can submit GPU work that induces PCIe non-fatal AER on amdgpu systems, matching the PR:L treatment used for related amdgpu AER path bugs; CAP_SYS_ADMIN aer_inject is not required.\nUI:N - The attacker triggers AER recovery and subsequent lock/scheduler corruption themselves through local GPU operations; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - Impact stays within the host kernel\u0027s amdgpu driver authority (deadlock and scheduler/fence list corruption); this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - On the non-fatal path, drm_sched_start(full_recovery=true) re-walks live pending jobs and re-adds dma_fence callbacks that are already linked, corrupting fence cb lists and racing the unparked sched thread on pending_list\u2014an UAF-class primitive enabling arbitrary kernel memory disclosure.\nI:H - The same unsynchronized pending_list walks, double fence-callback insertion, and job re-submission while rings are still running corrupt kernel list/fence state and are exploitable for arbitrary writes and control-flow hijacking; up_write without ownership further corrupts reset_sem concurrency assumptions.\nA:H - amdgpu_device_unlock_adev() calls up_write(\u0026adev-\u003ereset_sem) without a matching down_write on the pci_channel_io_normal path, producing a permanent deadlock for subsequent reset_sem takers, and the concurrent scheduler/fence corruption can also oops/panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:45.513Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/785cc093b6b5a93cc350421a55f3f1eda6585156"
        },
        {
          "url": "https://git.kernel.org/stable/c/72e9a1bf9b722628c28092e0c2cd8717edd201dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/248b061689a40f4fed05252ee2c89f87cf26d7d8"
        }
      ],
      "title": "drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47421",
    "datePublished": "2024-05-21T15:04:09.296Z",
    "dateReserved": "2024-05-21T14:58:30.820Z",
    "dateUpdated": "2026-08-05T08:47:45.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47421",
      "date": "2026-09-18",
      "epss": "0.00204",
      "percentile": "0.10739"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume\n\nIn current code, when a PCI error state pci_channel_io_normal is detectd,\nit will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI\ndriver will continue the execution of PCI resume callback report_resume by\npci_walk_bridge, and the callback will go into amdgpu_pci_resume\nfinally, where write lock is releasd unconditionally without acquiring\nsuch lock first. In this case, a deadlock will happen when other threads\nstart to acquire the read lock.\n\nTo fix this, add a member in amdgpu_device strucutre to cache\npci_channel_state, and only continue the execution in amdgpu_pci_resume\nwhen it\u0027s pci_channel_io_frozen."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: maneja el caso de pci_channel_io_frozen solo en amdgpu_pci_resume. En el c\u00f3digo actual, cuando se detecta un estado de error de PCI pci_channel_io_normal, informar\u00e1 el estado de PCI_ERS_RESULT_CAN_RECOVER al controlador PCI, y el controlador PCI contin\u00fae la ejecuci\u00f3n de PCI resume callback report_resume mediante pci_walk_bridge, y la devoluci\u00f3n de llamada finalmente ir\u00e1 a amdgpu_pci_resume, donde el bloqueo de escritura se libera incondicionalmente sin adquirir dicho bloqueo primero. En este caso, se producir\u00e1 un punto muerto cuando otros subprocesos comiencen a adquirir el bloqueo de lectura. Para solucionar este problema, agregue un miembro en la estructura amdgpu_device para almacenar en cach\u00e9 pci_channel_state y solo contin\u00fae la ejecuci\u00f3n en amdgpu_pci_resume cuando sea pci_channel_io_frozen."
        }
      ],
      "id": "CVE-2021-47421",
      "lastModified": "2024-11-21T06:36:06.613",
      "published": "2024-05-21T15:15:27.537",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/248b061689a40f4fed05252ee2c89f87cf26d7d8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/72e9a1bf9b722628c28092e0c2cd8717edd201dc"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/248b061689a40f4fed05252ee2c89f87cf26d7d8"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/72e9a1bf9b722628c28092e0c2cd8717edd201dc"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdgpu/amdgpu.h",
                  "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "785cc093b6b5a93cc350421a55f3f1eda6585156",
                    "status": "affected",
                    "version": "c9a6b82f45e261d247b980a7949aaa6a9bfffe01",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "72e9a1bf9b722628c28092e0c2cd8717edd201dc",
                    "status": "affected",
                    "version": "c9a6b82f45e261d247b980a7949aaa6a9bfffe01",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "248b061689a40f4fed05252ee2c89f87cf26d7d8",
                    "status": "affected",
                    "version": "c9a6b82f45e261d247b980a7949aaa6a9bfffe01",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdgpu/amdgpu.h",
                  "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.241",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.14.*",
                    "status": "unaffected",
                    "version": "5.14.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "308E1A35-3600-4D48-A9E3-D9446213F7C6",
                    "versionEndExcluding": "5.10.241",
                    "versionStartIncluding": "5.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "20EB962C-32DC-448F-A900-BCF9A726F9EB",
                    "versionEndExcluding": "5.14.12",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E46C74C6-B76B-4C94-A6A4-FD2FFF62D644",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "60134C3A-06E4-48C1-B04F-2903732A4E56",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "0460DA88-8FE1-46A2-9DDA-1F1ABA552E71",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "AF55383D-4DF2-45DC-93F7-571F4F978EAB",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume\n\nIn current code, when a PCI error state pci_channel_io_normal is detectd,\nit will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI\ndriver will continue the execution of PCI resume callback report_resume by\npci_walk_bridge, and the callback will go into amdgpu_pci_resume\nfinally, where write lock is releasd unconditionally without acquiring\nsuch lock first. In this case, a deadlock will happen when other threads\nstart to acquire the read lock.\n\nTo fix this, add a member in amdgpu_device strucutre to cache\npci_channel_state, and only continue the execution in amdgpu_pci_resume\nwhen it\u0027s pci_channel_io_frozen."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: maneja el caso de pci_channel_io_frozen solo en amdgpu_pci_resume. En el c\u00f3digo actual, cuando se detecta un estado de error de PCI pci_channel_io_normal, informar\u00e1 el estado de PCI_ERS_RESULT_CAN_RECOVER al controlador PCI, y el controlador PCI contin\u00fae la ejecuci\u00f3n de PCI resume callback report_resume mediante pci_walk_bridge, y la devoluci\u00f3n de llamada finalmente ir\u00e1 a amdgpu_pci_resume, donde el bloqueo de escritura se libera incondicionalmente sin adquirir dicho bloqueo primero. En este caso, se producir\u00e1 un punto muerto cuando otros subprocesos comiencen a adquirir el bloqueo de lectura. Para solucionar este problema, agregue un miembro en la estructura amdgpu_device para almacenar en cach\u00e9 pci_channel_state y solo contin\u00fae la ejecuci\u00f3n en amdgpu_pci_resume cuando sea pci_channel_io_frozen."
          }
        ],
        "id": "CVE-2021-47421",
        "lastModified": "2026-08-04T10:17:02.850",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47421",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:37:47.598437Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-21T15:15:27.537",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/248b061689a40f4fed05252ee2c89f87cf26d7d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/72e9a1bf9b722628c28092e0c2cd8717edd201dc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/785cc093b6b5a93cc350421a55f3f1eda6585156"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/248b061689a40f4fed05252ee2c89f87cf26d7d8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/72e9a1bf9b722628c28092e0c2cd8717edd201dc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-667"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:56:13+00:00",
      "cve": "CVE-2021-47421",
      "id": "CVE-2021-47421",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "60",
      "product_status:known_not_affected": "138",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47421.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:38:20Z",
      "cve": "CVE-2021-47421",
      "id": "CVE-2021-47421",
      "initial_release_date": "2024-05-28T03:33:56Z",
      "product_status:known_affected": "275",
      "product_status:known_not_affected": "266",
      "product_status:recommended": "452",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47421",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47421.json",
      "version": "56"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T17:30:56.972Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/72e9a1bf9b722628c28092e0c2cd8717edd201dc"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/248b061689a40f4fed05252ee2c89f87cf26d7d8"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47421",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:37:47.598437Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:13.673Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/amd/amdgpu/amdgpu.h",
                "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "785cc093b6b5a93cc350421a55f3f1eda6585156",
                  "status": "affected",
                  "version": "c9a6b82f45e261d247b980a7949aaa6a9bfffe01",
                  "versionType": "git"
                },
                {
                  "lessThan": "72e9a1bf9b722628c28092e0c2cd8717edd201dc",
                  "status": "affected",
                  "version": "c9a6b82f45e261d247b980a7949aaa6a9bfffe01",
                  "versionType": "git"
                },
                {
                  "lessThan": "248b061689a40f4fed05252ee2c89f87cf26d7d8",
                  "status": "affected",
                  "version": "c9a6b82f45e261d247b980a7949aaa6a9bfffe01",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/amd/amdgpu/amdgpu.h",
                "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.10"
                },
                {
                  "lessThan": "5.10",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.241",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.14.*",
                  "status": "unaffected",
                  "version": "5.14.12",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.15",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.241",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.14.12",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume\n\nIn current code, when a PCI error state pci_channel_io_normal is detectd,\nit will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI\ndriver will continue the execution of PCI resume callback report_resume by\npci_walk_bridge, and the callback will go into amdgpu_pci_resume\nfinally, where write lock is releasd unconditionally without acquiring\nsuch lock first. In this case, a deadlock will happen when other threads\nstart to acquire the read lock.\n\nTo fix this, add a member in amdgpu_device strucutre to cache\npci_channel_state, and only continue the execution in amdgpu_pci_resume\nwhen it\u0027s pci_channel_io_frozen."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable amdgpu PCI ERS callbacks are reached only from local PCIe AER non-fatal recovery on the AMD GPU (or local aer_inject), not from network packet processing or adjacent-link protocols.\nAC:L - Once a non-fatal AER recovery runs, amdgpu_pci_resume deterministically unlocks without locking and operates on live schedulers; an attacker who can induce AER via GPU work can retry until in-flight jobs make the corruption path hit, with no luck-based race beyond their control.\nPR:L - An unprivileged local user with DRM render-node access (/dev/dri/renderD*, DRM_RENDER_ALLOW ioctls) can submit GPU work that induces PCIe non-fatal AER on amdgpu systems, matching the PR:L treatment used for related amdgpu AER path bugs; CAP_SYS_ADMIN aer_inject is not required.\nUI:N - The attacker triggers AER recovery and subsequent lock/scheduler corruption themselves through local GPU operations; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - Impact stays within the host kernel\u0027s amdgpu driver authority (deadlock and scheduler/fence list corruption); this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - On the non-fatal path, drm_sched_start(full_recovery=true) re-walks live pending jobs and re-adds dma_fence callbacks that are already linked, corrupting fence cb lists and racing the unparked sched thread on pending_list\u2014an UAF-class primitive enabling arbitrary kernel memory disclosure.\nI:H - The same unsynchronized pending_list walks, double fence-callback insertion, and job re-submission while rings are still running corrupt kernel list/fence state and are exploitable for arbitrary writes and control-flow hijacking; up_write without ownership further corrupts reset_sem concurrency assumptions.\nA:H - amdgpu_device_unlock_adev() calls up_write(\u0026adev-\u003ereset_sem) without a matching down_write on the pci_channel_io_normal path, producing a permanent deadlock for subsequent reset_sem takers, and the concurrent scheduler/fence corruption can also oops/panic the kernel."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:47:45.513Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/785cc093b6b5a93cc350421a55f3f1eda6585156"
            },
            {
              "url": "https://git.kernel.org/stable/c/72e9a1bf9b722628c28092e0c2cd8717edd201dc"
            },
            {
              "url": "https://git.kernel.org/stable/c/248b061689a40f4fed05252ee2c89f87cf26d7d8"
            }
          ],
          "title": "drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47421",
        "datePublished": "2024-05-21T15:04:09.296Z",
        "dateReserved": "2024-05-21T14:58:30.820Z",
        "dateUpdated": "2026-08-05T08:47:45.513Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.