What’s Vulnerable › Vulnerabilities

CVE-2021-47360: binder: make sure fd closes complete

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-21 · updated 2026-06-17
• Weakness: CWE-252

Description

In the Linux kernel, the following vulnerability has been resolved: binder: make sure fd closes complete During BC_FREE_BUFFER processing, the BINDER_TYPE_FDA object cleanup may close 1 or more fds. The close operations are completed using the task work mechanism -- which means the thread needs to return to userspace or the file object may never be dereferenced -- which can lead to hung processes. Force the binder thread back to userspace if an fd is closed during BC_FREE_BUFFER handling.

Affected products

• Linux kernel: from 5.0 before 5.4.150; from 5.5 before 5.10.70; from 5.11 before 5.14.9; 4.20.1, 5.15-rc1, 5.15-rc2 — fixed in 5.10.70, 5.14.9, 5.4.150

How to fix

Upgrade to a fixed version: Linux kernel 5.10.70, 5.14.9, 5.4.150. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/5fdb55c1ac9585eb23bb2541d5819224429e103d
• https://git.kernel.org/stable/c/aa2c274c279ff365a06a4cba263f04965895166e
• https://git.kernel.org/stable/c/b95483d8d94b41fa31a84c1d86710b7907a37621
• https://git.kernel.org/stable/c/d5b0473707fa53b03a5db0256ce62b2874bddbc7
• https://git.kernel.org/stable/c/5fdb55c1ac9585eb23bb2541d5819224429e103d
• https://git.kernel.org/stable/c/aa2c274c279ff365a06a4cba263f04965895166e
• https://git.kernel.org/stable/c/b95483d8d94b41fa31a84c1d86710b7907a37621
• https://git.kernel.org/stable/c/d5b0473707fa53b03a5db0256ce62b2874bddbc7

Get alerted when CVE-2021-47360 or the next vulnerability affects your stack