CVE-2021-47566

proc/vmcore: fix clearing user buffer by properly using clear_user()

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

proc/vmcore: fix clearing user buffer by properly using clear_user()

To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a vmcore_cb and has some logically unplugged memory inside an added Linux memory block, I can easily trigger a BUG by copying the vmcore via "cp":

systemd[1]: Starting Kdump Vmcore Save Service... kdump[420]: Kdump is using the default log level(3). kdump[453]: saving to /sysroot/var/crash/127.0.0.1-2021-11-11-14:59:22/ kdump[458]: saving vmcore-dmesg.txt to /sysroot/var/crash/127.0.0.1-2021-11-11-14:59:22/ kdump[465]: saving vmcore-dmesg.txt complete kdump[467]: saving vmcore BUG: unable to handle page fault for address: 00007f2374e01000 #PF: supervisor write access in kernel mode #PF: error_code(0x0003) - permissions violation PGD 7a523067 P4D 7a523067 PUD 7a528067 PMD 7a525067 PTE 800000007048f867 Oops: 0003 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 468 Comm: cp Not tainted 5.15.0+ #6 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-27-g64f37cc530f1-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_from_oldmem.part.0.cold+0x1d/0x86 Code: ff ff ff e8 05 ff fe ff e9 b9 e9 7f ff 48 89 de 48 c7 c7 38 3b 60 82 e8 f1 fe fe ff 83 fd 08 72 3c 49 8d 7d 08 4c 89 e9 89 e8 <49> c7 45 00 00 00 00 00 49 c7 44 05 f8 00 00 00 00 48 83 e7 f81 RSP: 0018:ffffc9000073be08 EFLAGS: 00010212 RAX: 0000000000001000 RBX: 00000000002fd000 RCX: 00007f2374e01000 RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00007f2374e01008 RBP: 0000000000001000 R08: 0000000000000000 R09: ffffc9000073bc50 R10: ffffc9000073bc48 R11: ffffffff829461a8 R12: 000000000000f000 R13: 00007f2374e01000 R14: 0000000000000000 R15: ffff88807bd421e8 FS: 00007f2374e12140(0000) GS:ffff88807f000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2374e01000 CR3: 000000007a4aa000 CR4: 0000000000350eb0 Call Trace: read_vmcore+0x236/0x2c0 proc_reg_read+0x55/0xa0 vfs_read+0x95/0x190 ksys_read+0x4f/0xc0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae

Some x86-64 CPUs have a CPU feature called "Supervisor Mode Access Prevention (SMAP)", which is used to detect wrong access from the kernel to user buffers like this: SMAP triggers a permissions violation on wrong access. In the x86-64 variant of clear_user(), SMAP is properly handled via clac()+stac().

To fix, properly use clear_user() when we're dealing with a user buffer.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.23%Up 0.2 points since May 25, 2024

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

proc/vmcore: fix clearing user buffer by properly using clear_user()

To fix, properly use clear_user() when we're dealing with a user buffer.

Record: CVE-2021-47566
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

proc/vmcore: fix clearing user buffer by properly using clear_user()

In the Linux kernel, the following vulnerability has been resolved:

proc/vmcore: fix clearing user buffer by properly using clear_user()

To fix, properly use clear_user() when we're dealing with a user buffer.

Record: CVE-2021-47566
Updated: 2026-11-02

EUVDEUVD-2021-34568 No score

In the Linux kernel, the following vulnerability has been resolved:

proc/vmcore: fix clearing user buffer by properly using clear_user()

To fix, properly use clear_user() when we're dealing with a user buffer.

Record: EUVD-2021-34568
Updated: 2026-11-02

OSV 7.8

In the Linux kernel, the following vulnerability has been resolved:

proc/vmcore: fix clearing user buffer by properly using clear_user()

To fix, properly use clear_user() when we're dealing with a user buffer.

Record: CVE-2021-47566
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-47566 7.8

In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user buffer by properly using clear_user() To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a vmcore_cb and has some logically unplugged memory inside an added Linux memory block, I can easily trigger a BUG by copying the vmcore via "cp": systemd[1]: Starting Kdump Vmcore Save Service... kdump[420]: Kdump is using the default log level(3). kdump[453]: saving to /sysroot/var/crash/127.0.0.1-2021-11-11-14:59:22/ kdump[458]: saving vmcore-dmesg.txt to /sysroot/var/crash/127.0.0.1-2021-11-11-14:59:22/ kdump[465]: saving vmcore-dmesg.txt complete kdump[467]: saving vmcore BUG: unable to handle page fault for address: 00007f2374e01000 #PF: supervisor write access in kernel mode #PF: error_code(0x0003) - permissions violation PGD 7a523067 P4D 7a523067 PUD 7a528067 PMD 7a525067 PTE 800000007048f867 Oops: 0003 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 468 Comm: cp Not tainted 5.15.0+ #6 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-27-g64f37cc530f1-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_from_oldmem.part.0.cold+0x1d/0x86 Code: ff ff ff e8 05 ff fe ff e9 b9 e9 7f ff 48 89 de 48 c7 c7 38 3b 60 82 e8 f1 fe fe ff 83 fd 08 72 3c 49 8d 7d 08 4c 89 e9 89 e8 <49> c7 45 00 00 00 00 00 49 c7 44 05 f8 00 00 00 00 48 83 e7 f81 RSP: 0018:ffffc9000073be08 EFLAGS: 00010212 RAX: 0000000000001000 RBX: 00000000002fd000 RCX: 00007f2374e01000 RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00007f2374e01008 RBP: 0000000000001000 R08: 0000000000000000 R09: ffffc9000073bc50 R10: ffffc9000073bc48 R11: ffffffff829461a8 R12: 000000000000f000 R13: 00007f2374e01000 R14: 0000000000000000 R15: ffff88807bd421e8 FS: 00007f2374e12140(0000) GS:ffff88807f000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2374e01000 CR3: 000000007a4aa000 CR4: 0000000000350eb0 Call Trace: read_vmcore+0x236/0x2c0 proc_reg_read+0x55/0xa0 vfs_read+0x95/0x190 ksys_read+0x4f/0xc0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae Some x86-64 CPUs have a CPU feature called "Supervisor Mode Access Prevention (SMAP)", which is used to detect wrong access from the kernel to user buffers like this: SMAP triggers a permissions violation on wrong access. In the x86-64 variant of clear_user(), SMAP is properly handled via clac()+stac(). To fix, properly use clear_user() when we're dealing with a user buffer.

Record: DEBIAN-CVE-2021-47566
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:5281 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:5281
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 11 moreShow less

OSVRHSA-2024:6993 7.1

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:6993
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-47566 7.8

Record: UBUNTU-CVE-2021-47566
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-11

OSVCLSA-2025-1763991095 No score

Fix of 25 CVEs

Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21772
- partitions: mac: fix handling of bogus partition table
CVE-url: https://ubuntu.com/security/CVE-2025-22079
- ocfs2: validate l_tree_depth to avoid out-of-bounds access
CVE-url: https://ubuntu.com/security/CVE-2024-58014
- wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
CVE-url: https://ubuntu.com/security/CVE-2024-41042
- netfilter: nf_tables: prefer nft_chain_validate
CVE-url: https://ubuntu.com/security/CVE-2024-46713
- perf/aux: Fix AUX buffer serialization
CVE-url: https://ubuntu.com/security/CVE-2025-38352
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
CVE-url: https://ubuntu.com/security/CVE-2025-38477
- net/sched: sch_qfq: Fix race condition on qfq_aggregate
Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
- fs/jfs: Add check for negative db_l2nbperpage
- fs/jfs: Add validity check for db_maxag and db_agpref
Focal update: v5.4.251 upstream stable release (LP: #2034918) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
- jfs: jfs_dmap: Validate db_l2nbperpage while mounting
Bionic update: upstream stable patchset 2023-02-06 (LP: #2006403) // CVE- url: https://ubuntu.com/security/CVE-2023-52804
- fs: jfs: fix shift-out-of-bounds in dbAllocAG
CVE-url: https://ubuntu.com/security/CVE-2022-25265
- x86/elf: Add table to document READ_IMPLIES_EXEC
- x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK
- x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit
Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47153
- i2c: i801: Don't generate an interrupt on bus reset
Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48757
- net: fix information leakage in /proc/net/ptype
Focal update: v5.4.279 upstream stable release (LP: #2073621) // CVE-url: https://ubuntu.com/security/CVE-2024-37078
- nilfs2: fix potential kernel bug due to lack of writeback flag waiting
Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48760
- USB: core: Fix hang in usb_kill_urb by adding memory barriers
Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47383
- tty: Fix out-of-bound vmalloc access in imageblit
Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2022-49145
- ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
Bionic update: upstream stable patchset 2021-11-23 (LP: #1951997) // CVE- url: https://ubuntu.com/security/CVE-2021-47458
- ocfs2: mount fails with buffer overflow in strlen
CVE-url: https://ubuntu.com/security/CVE-2022-49170
- f2fs: fix to do sanity check on curseg->alloc_type
CVE-url: https://ubuntu.com/security/CVE-2021-47479
- staging: rtl8712: fix use-after-free in rtl8712_dl_fw
Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE- url: https://ubuntu.com/security/CVE-2021-47477
- comedi: dt9812: fix DMA buffers on stack
Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2021-47642
- video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47565
- scsi: mpt3sas: Fix kernel panic during drive powercycle test
Bionic update: upstream stable patchset 2022-01-06…

Record: CLSA-2025-1763991095
Updated: 2026-11-02

OSVCLSA-2026-1782145985 No score

kernel: Fix of 62 CVEs

libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
kyber: fix out of bounds access when preempted {CVE-2021-46984}
can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
tls: separate no-async decryption request handling from async {CVE-2024-58240}
ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
nfsd: fix use-after-free due to delegation race {CVE-2021-47506}
drm: bridge/panel: Cleanup connector on bridge detach {CVE-2021-47063}
usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer {CVE-2021-47226}
kvm: LAPIC: Restore guard to prevent illegal APIC register access {CVE-2021-47255}
tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) {CVE-2019-7221}
RDMA/umad: Reject negative data_len in…

Record: CLSA-2026-1782145985
Updated: 2026-11-02

OSVCLSA-2026-1782146775 No score

kernel: Fix of 58 CVEs

libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
drm/i915/gem: Really move i915_gem_context.link under ref protection {CVE-2022-48662}
drm/i915: Release i915_gem_context from a worker {CVE-2022-48662}
KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094}
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device {CVE-2023-53393}
scsi: target: iscsi: Fix a race condition between login_work and the login thread {CVE-2022-50350}
Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
ice: Fix memory corruption in VF driver {CVE-2022-49722}
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
netfilter: nf_conntrack_helper: pass helper to…

Record: CLSA-2026-1782146775
Updated: 2026-11-02

OSVSUSE-SU-2024:2360-1 No score