CVE-2021-47576: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernelbefore 4.9.294
• linux linux kernel4.10 and later · before 4.14.259
• linux linux kernel4.15 and later · before 4.19.222
• linux linux kernel4.20 and later · before 5.4.168
• linux linux kernel5.5 and later · before 5.10.88
• linux linux kernel5.11 and later · before 5.15.11

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 2.6.19affected
  • 231839102b54512ced7d3ee7fc9b8bcf5e3b583b and later · before adcecd50da6cab7b4957cba0606771dcc846c5a9affected · git
  • 231839102b54512ced7d3ee7fc9b8bcf5e3b583b and later · before 90491283b4064220682e4b0687d07b05df01e3bfaffected · git
  • 231839102b54512ced7d3ee7fc9b8bcf5e3b583b and later · before 04181973c38f3d6a353f9246dcf7fee08024fd9eaffected · git
  • 231839102b54512ced7d3ee7fc9b8bcf5e3b583b and later · before b847ecff850719c46c95acd25a0d555dfd16e10daffected · git
  • 231839102b54512ced7d3ee7fc9b8bcf5e3b583b and later · before a9078e791426c2cbbdf28a320c3670f6e0a611e6affected · git
  • 231839102b54512ced7d3ee7fc9b8bcf5e3b583b and later · before dfc3fff63793c571147930b13c0f8c689c4281acaffected · git
  • 231839102b54512ced7d3ee7fc9b8bcf5e3b583b and later · before e0a2c28da11e2c2b963fc01d50acbf03045ac732affected · git
  • before 2.6.19not affected · semver
  • 4.9.294 and later · up to and including 4.9.*not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2024-38617Jun 19, 2024 · kunit/fortify: Fix mismatched kvalloc()/vfree() usage
  22Monitor
• ← EarlierCVE-2024-38618Jun 19, 2024 · ALSA: timer: Set lower bound of start tick time
  22Monitor
• Later →CVE-2021-47577Jun 19, 2024 · io-wq: check for wq exit after adding new worker task_work
  18Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.