CVE-2021-47646: Revert "Revert "block, bfq: honor already-setup queue merges""
In the Linux kernel, the following vulnerability has been resolved:
Revert "Revert "block, bfq: honor already-setup queue merges""
A crash [1] happened to be triggered in conjunction with commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges"). The latter was then reverted by commit ebc69e897e17 ("Revert "block, bfq: honor already-setup queue merges""). Yet, the reverted commit was not the one introducing the bug. In fact, it actually triggered a UAF introduced by a different commit, and now fixed by commit d29bd41428cf ("block, bfq: reset lastbfqqcreated on group change").
So, there is no point in keeping commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges") out. This commit restores it.
[1] https://bugzilla.kernel.org/showbug.cgi?id=214503
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch d29bd41428cf
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47646?
CVE-2021-47646 has been rated with a medium severity due to the potential for system crashes.
What versions of the Linux kernel are affected by CVE-2021-47646?
CVE-2021-47646 affects Linux kernel versions from 4.20 up to 5.17.2.
How do I fix CVE-2021-47646?
To fix CVE-2021-47646, update your Linux kernel to a version above 5.17.2.
What type of vulnerability is CVE-2021-47646?
CVE-2021-47646 is a stability vulnerability in the Linux kernel that can lead to system crashes.
Is there a workaround for CVE-2021-47646?
No specific workarounds are recommended for CVE-2021-47646; updating the kernel is the best course of action.