CVE-2021-47616
RDMA: Fix use-after-free in rxe_queue_cleanup
Reported by linux · Published June 19, 2024
In the Linux kernel, the following vulnerability has been resolved: RDMA: Fix use-after-free in rxe_queue_cleanup On error handling path in rxe_qp_from_init() qp->sq.queue is freed and then rxe_create_qp() will drop last reference to this object. qp clean up function will try to free this queue one time and it causes UAF bug. Fix it by zeroing queue pointer after freeing queue in rxe_qp_from_init().
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Linux | Linux | acb53e47db1fbc7cd37ab10b46388f045a76e383, 84b01721e8042cdd1e8ffeb648844a09cd4213e0, 5.15 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 514aee660df493cd673154a6ba6bab745ec47b8c, 514aee660df493cd673154a6ba6bab745ec47b8c |
| Linux | Linux | 5.15, 0, 5.15.10 |
| Linux | Linux | 0, 5.15.10, 5.16 |
| linux | linux_kernel | 5.15, 5.15 |
Timeline
- Jun 19, 2024 CVE Published
- Jun 20, 2024 EPSS Score (30 in total, the first dated here)
- Jun 2, 2026 Security Advisory (303 in total, the first dated here)
- Jul 13, 2026 Coalition ESS Score
- Sep 9, 2026 Distribution Patch (226 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-47616
vulnetix vdb fixes CVE-2021-47616Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-47616/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart