CVE-2021-47461: userfaultfd: fix a race between writeprotect and exit_mmap()

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-22 · updated 2026-08-04
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a race between writeprotect and exit_mmap() A race is possible when a process exits, its VMAs are removed by exit_mmap() and at the same time userfaultfd_writeprotect() is called. The race was detected by KASAN on a development kernel, but it appears to be possible on vanilla kernels as well. Use mmget_not_zero() to prevent the race as done in other userfaultfd operations.

Affected products

Linux kernel: from 5.7 before 5.10.76; from 5.11 before 5.14.15; 5.15-rc1, 5.15-rc2, 5.15-rc3, 5.15-rc4, 5.15-rc5, 5.15-rc6 — fixed in 5.10.76, 5.14.15

How to fix

Upgrade to a fixed version: Linux kernel 5.10.76, 5.14.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47461 or the next vulnerability affects your stack