{"id":"CVE-2021-47012","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix a use after free in siw_alloc_mr\n\nOur code analyzer reported a UAF.\n\nIn siw_alloc_mr(), it calls siw_mr_add_mem(mr,..)","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix a use after free in siw_alloc_mr\n\nOur code analyzer reported a UAF.\n\nIn siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of\nsiw_mr_ad…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.3, < 5.4.119","linux_kernel >= 5.5, < 5.10.37","linux_kernel >= 5.11, < 5.11.21","linux_kernel >= 5.12, < 5.12.4"],"patched":["linux_kernel 5.12.4"],"published":"2024-02-28","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-47012","references":[{"url":"https://git.kernel.org/stable/c/3093ee182f01689b89e9f8797b321603e5de4f63","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3e22b88e02c194f6c80867abfef5cc09383461f4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad9ce7188432650469a6c7625bf479f5ed0b6155","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3093ee182f01689b89e9f8797b321603e5de4f63","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/3e22b88e02c194f6c80867abfef5cc09383461f4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/ad9ce7188432650469a6c7625bf479f5ed0b6155","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00268,"epssPercentile":0.19217,"ingestedAt":"2026-08-04T10:39:39.119Z","slug":"CVE-2021-47012","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix a use after free in siw_alloc_mr\n\nOur code analyzer reported a UAF.\n\nIn siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of\nsiw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via\nkfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a\nfreed object. After, the execution continue up to the err_out branch of\nsiw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).\n\nMy patch moves \"mr->mem = mem\" behind the if (xa_alloc_cyclic(..)<0) {}\nsection, to avoid the uaf.\n\n## Affected\n\n- `linux_kernel >= 5.3, < 5.4.119`\n- `linux_kernel >= 5.5, < 5.10.37`\n- `linux_kernel >= 5.11, < 5.11.21`\n- `linux_kernel >= 5.12, < 5.12.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 5.12.4`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}