{
  "cveId": "CVE-2021-47209",
  "url": "https://patchblox.com/security/cve/CVE-2021-47209",
  "summary": "CVE-2021-47209 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47209, released April 10, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  sched/fair: Prevent dead task groups from regain...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  sched/fair: Prevent dead task groups from regaining cfs_rq\u0027s  Kevin is reporting crashes which point to a use-after-free of a cfs_rq in update_blocked_averages(). Initial debugging revealed that we\u0027ve live cfs_rq\u0027s (on_list=1) in an about to be kfree()\u0027d task group in free_fair_sched_group(). However, it was unclear how that can happen.  His kernel config happened to lead to a layout of struct sched_entity that put the \u0027my_q\u0027 member directly into the middle of the object which makes it incidentally overlap with SLUB\u0027s freelist pointer. That, in combination with SLAB_FREELIST_HARDENED\u0027s freelist pointer mangling, leads to a reliable access violation in form of a #GP which made the UAF fail fast.  Michal seems to have run into the same issue[1]. He already correctly diagnosed that commit a7b359fc6a37 (\u0022sched/fair: Correctly insert cfs_rq\u0027s to list on unthrottle\u0022) is causing the preconditions for the UAF to happen by re-adding cfs_rq\u0027s also to task groups that have no more running tasks, i.e. also to dead ones. His analysis, however, misses the real root cause and it cannot be seen from the crash backtrace only, as the real offender is tg_unthrottle_up() getting called via sched_cfs_period_timer() via the timer interrupt at an inconvenient time.  When unregister_fair_sched_group() unlinks all cfs_rq\u0027s from the dying task group, it doesn\u0027t protect itself from getting interrupted. If the timer interrupt triggers while we iterate over all CPUs or after unregister_fair_sched_group() has finished but prior to unlinking the task group, sched_cfs_period_timer() will execute and walk the list of task groups, trying to unthrottle cfs_rq\u0027s, i.e. re-add them to the dying task group. These will later -- in free_fair_sched_group() -- be kfree()\u0027ed while still being linked, leading to the fireworks Kevin and Michal are seeing.  To fix this race, ensure the dying task group gets unlinked first. However, simply switching the order of unregistering and unlinking the task group isn\u0027t sufficient, as concurrent RCU walkers might still see it, as can be seen below:      CPU1:                                      CPU2:       :                                        timer IRQ:       :                                          do_sched_cfs_period_timer():       :                                            :       :                                            distribute_cfs_runtime():       :                                              rcu_read_lock();       :                                              :       :                                              unthrottle_cfs_rq():     sched_offline_group():                             :       :                                                walk_tg_tree_from(\u2026,tg_unthrottle_up,\u2026):       list_del_rcu(\u0026tg-\u003Elist);                           :  (1)  :                                                  list_for_each_entry_rcu(child, \u0026parent-\u003Echildren, siblings)       :                                                    :  (2)  list_del_rcu(\u0026tg-\u003Esiblings);                         :       :                                                    tg_unthrottle_up():       unregister_fair_sched_group():                         struct cfs_rq *cfs_rq = tg-\u003Ecfs_rq[cpu_of(rq)];         :                                                    :         list_del_leaf_cfs_rq(tg-\u003Ecfs_rq[cpu]);               :         :                                                    :         :                                                    if (!cfs_rq_is_decayed(cfs_rq) || cfs_rq-\u003Enr_running)  (3)    :                                                        list_add_leaf_cfs_rq(cfs_rq);       :                                                      :       :                                                    :       :                                                  :       :                                                :       :                            ---truncated---",
  "published": "2024-04-10T19:15:48Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00208,
  "epssPercentile": 0.10974,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.15.5-1",
      "fix": "DEBIAN-CVE-2021-47209",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47209",
      "released": "2024-04-10T19:15:48Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.15.5-1",
      "fix": "DEBIAN-CVE-2021-47209",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47209",
      "released": "2024-04-10T19:15:48Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.15.5-1",
      "fix": "DEBIAN-CVE-2021-47209",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47209",
      "released": "2024-04-10T19:15:48Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}