{
  "cveId": "CVE-2021-46921",
  "url": "https://patchblox.com/security/cve/CVE-2021-46921",
  "summary": "CVE-2021-46921 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-46921, released February 27, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  locking/qrwlock: Fix ordering in queued_write_lo...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  locking/qrwlock: Fix ordering in queued_write_lock_slowpath()  While this code is executed with the wait_lock held, a reader can acquire the lock without holding wait_lock.  The writer side loops checking the value with the atomic_cond_read_acquire(), but only truly acquires the lock when the compare-and-exchange is completed successfully which isn\u2019t ordered. This exposes the window between the acquire and the cmpxchg to an A-B-A problem which allows reads following the lock acquisition to observe values speculatively before the write lock is truly acquired.  We\u0027ve seen a problem in epoll where the reader does a xchg while holding the read lock, but the writer can see a value change out from under it.    Writer                                | Reader   --------------------------------------------------------------------------------   ep_scan_ready_list()                  |   |- write_lock_irq()                   |       |- queued_write_lock_slowpath()   | \t|- atomic_cond_read_acquire()   | \t\t\t\t        | read_lock_irqsave(\u0026ep-\u003Elock, flags);      --\u003E (observes value before unlock) |  chain_epi_lockless()      |                                  |    epi-\u003Enext = xchg(\u0026ep-\u003Eovflist, epi);      |                                  | read_unlock_irqrestore(\u0026ep-\u003Elock, flags);      |                                  |      |     atomic_cmpxchg_relaxed()     |      |-- READ_ONCE(ep-\u003Eovflist);        |  A core can order the read of the ovflist ahead of the atomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire semantics addresses this issue at which point the atomic_cond_read can be switched to use relaxed semantics.  [peterz: use try_cmpxchg()]",
  "published": "2024-02-27T10:15:06Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.00237,
  "epssPercentile": 0.14827,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.10.38-1",
      "fix": "DEBIAN-CVE-2021-46921",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-46921",
      "released": "2024-02-27T10:15:06Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.10.38-1",
      "fix": "DEBIAN-CVE-2021-46921",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-46921",
      "released": "2024-02-27T10:15:06Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.10.38-1",
      "fix": "DEBIAN-CVE-2021-46921",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-46921",
      "released": "2024-02-27T10:15:06Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T01:44:33Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}