What’s Vulnerable › Vulnerabilities

CVE-2021-47296: KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-21 · updated 2026-08-04
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak vcpu_put is not called if the user copy fails. This can result in preempt notifier corruption and crashes, among other issues.

Affected products

• Linux kernel: from 4.18 before 4.19.199; from 4.20 before 5.4.136; from 5.5 before 5.10.54; from 5.11 before 5.13.6; 5.14-rc1, 5.14-rc2 — fixed in 4.19.199, 5.10.54, 5.13.6, 5.4.136

How to fix

Upgrade to a fixed version: Linux kernel 4.19.199, 5.10.54, 5.13.6, 5.4.136. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50
• https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209
• https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252
• https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533
• https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151
• https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50
• https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209
• https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252
• https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533
• https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151

Get alerted when CVE-2021-47296 or the next vulnerability affects your stack