In the Linux kernel, the following vulnerability has been resolved: KVM: Stop looking for coalesced MMIO zones if the bus is destroyed Abort the walk of coalesced MMIO zones if kvm_io_bus_unregister_dev() fails to allocate memory for the new instance of the bus. If it can't instantiate a new bus, unregister_dev() destroys all devices _except_ the target device. But, it doesn't tell the caller that it obliterated the bus and invoked the destructor for all devices that were on the bus. In the coalesced MMIO case, this can result in a deleted list entry dereference due to attempting to continue iterating on coalesced_zones after future entries (in the walk) have been deleted. Opportunistically add curly braces to the for-loop, which encompasses many lines but sneaks by without braces due to the guts being a single if statement.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/168e82f640ed1891a700bdb43e37da354b2ab63c cve-icon cve-icon
https://git.kernel.org/stable/c/2a20592baff59c5351c5200ec667e1a2aa22af85 cve-icon cve-icon
https://git.kernel.org/stable/c/50cbad42bfea8c052b7ca590bd4126cdc898713c cve-icon cve-icon
https://git.kernel.org/stable/c/5d3c4c79384af06e3c8e25b7770b6247496b4417 cve-icon cve-icon
https://git.kernel.org/stable/c/7d1bc32d6477ff96a32695ea4be8144e4513ab2d cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024022952-CVE-2021-47060-d2ce@gregkh/T/#u cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47060 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47060 cve-icon
History

Tue, 04 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 08 Apr 2025 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Thu, 07 Nov 2024 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H'}

Mon, 04 Nov 2024 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-02-29T22:37:34.885Z

Updated: 2026-08-04T08:58:30.825Z

Reserved: 2024-02-29T22:33:44.294Z

Link: CVE-2021-47060

cve-icon Vulnrichment

Updated: 2024-08-04T05:24:39.796Z

cve-icon NVD

Status : Analyzed

Published: 2024-02-29T23:15:07.740

Modified: 2026-06-17T04:16:20.843

Link: CVE-2021-47060

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-02-29T00:00:00Z

Links: CVE-2021-47060 - Bugzilla