{
  "cveId": "CVE-2021-47387",
  "url": "https://patchblox.com/security/cve/CVE-2021-47387",
  "summary": "CVE-2021-47387 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47387, released May 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  cpufreq: schedutil: Use kobject release() method...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  cpufreq: schedutil: Use kobject release() method to free sugov_tunables  The struct sugov_tunables is protected by the kobject, so we can\u0027t free it directly. Otherwise we would get a call trace like this:   ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn\u002B0x0/0x30   WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object\u002B0xb8/0x100   Modules linked in:   CPU: 3 PID: 720 Comm: a.sh Tainted: G        W         5.14.0-rc1-next-20210715-yocto-standard\u002B #507   Hardware name: Marvell OcteonTX CN96XX board (DT)   pstate: 40400009 (nZcv daif \u002BPAN -UAO -TCO BTYPE=--)   pc : debug_print_object\u002B0xb8/0x100   lr : debug_print_object\u002B0xb8/0x100   sp : ffff80001ecaf910   x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80   x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000   x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20   x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010   x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365   x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69   x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0   x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001   x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000   x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000   Call trace:    debug_print_object\u002B0xb8/0x100    __debug_check_no_obj_freed\u002B0x1c0/0x230    debug_check_no_obj_freed\u002B0x20/0x88    slab_free_freelist_hook\u002B0x154/0x1c8    kfree\u002B0x114/0x5d0    sugov_exit\u002B0xbc/0xc0    cpufreq_exit_governor\u002B0x44/0x90    cpufreq_set_policy\u002B0x268/0x4a8    store_scaling_governor\u002B0xe0/0x128    store\u002B0xc0/0xf0    sysfs_kf_write\u002B0x54/0x80    kernfs_fop_write_iter\u002B0x128/0x1c0    new_sync_write\u002B0xf0/0x190    vfs_write\u002B0x2d4/0x478    ksys_write\u002B0x74/0x100    __arm64_sys_write\u002B0x24/0x30    invoke_syscall.constprop.0\u002B0x54/0xe0    do_el0_svc\u002B0x64/0x158    el0_svc\u002B0x2c/0xb0    el0t_64_sync_handler\u002B0xb0/0xb8    el0t_64_sync\u002B0x198/0x19c   irq event stamp: 5518   hardirqs last  enabled at (5517): [\u003Cffff8000100cbd7c\u003E] console_unlock\u002B0x554/0x6c8   hardirqs last disabled at (5518): [\u003Cffff800010fc0638\u003E] el1_dbg\u002B0x28/0xa0   softirqs last  enabled at (5504): [\u003Cffff8000100106e0\u003E] __do_softirq\u002B0x4d0/0x6c0   softirqs last disabled at (5483): [\u003Cffff800010049548\u003E] irq_exit\u002B0x1b0/0x1b8  So split the original sugov_tunables_free() into two functions, sugov_clear_global_tunables() is just used to clear the global_tunables and the new sugov_tunables_free() is used as kobj_type::release to release the sugov_tunables safely.",
  "published": "2024-05-21T15:15:24Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00251,
  "epssPercentile": 0.16546,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.14.12-1",
      "fix": "DEBIAN-CVE-2021-47387",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47387",
      "released": "2024-05-21T15:15:24Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.14.12-1",
      "fix": "DEBIAN-CVE-2021-47387",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47387",
      "released": "2024-05-21T15:15:24Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.14.12-1",
      "fix": "DEBIAN-CVE-2021-47387",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47387",
      "released": "2024-05-21T15:15:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}