{"id":"CVE-2021-47179","state":"PUBLISHED","title":"NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()\n\nCommit de144ff4234f changes _pnfs_return_layout() to call\npnfs_mark_matching_lsegs_return() passing NULL as the struct\npnfs_layout_range argument. Unfortunately,\npnfs_mark_matching_lsegs_return() doesn't check if we have a value here\nbefore dereferencing it, causing an oops.\n\nI'm able to hit this crash consistently when running connectathon basic\ntests on NFS v4.1/v4.2 against Ontap.","publishedAt":"2024-03-25T09:16:28.787Z","updatedAt":"2026-08-05T08:46:31.594Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"80e34f4957ec3010c85f9bb0b568a8d46acdf535","status":"affected","lessThan":"4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42","versionType":"git"},{"version":"7b7b9774643220e53eef58c15bb29bd4182fe053","status":"affected","lessThan":"42637ca25c7d7b5a92804a679af5192e8c1a9f48","versionType":"git"},{"version":"9ffa7967f9379a0a1b924e9ffeda709d72237da7","status":"affected","lessThan":"39785761feadf261bc5101372b0b0bbaf6a94494","versionType":"git"},{"version":"6be0e4b59314e4a836495f6ffdc5d2c5b079deeb","status":"affected","lessThan":"aba3c7795f51717ae316f3566442dee7cc3eeccb","versionType":"git"},{"version":"2fafe7d5047f98791afd9a1d90d2afb70debc590","status":"affected","lessThan":"f9890652185b72b8de9ebeb4406037640b6e1b53","versionType":"git"},{"version":"7e65ea887d0c0997f3053acd91a027af45e71c5b","status":"affected","lessThan":"b090d110e66636bca473fd8b98d5c97b555a965a","versionType":"git"},{"version":"de144ff4234f935bd2150108019b5d87a90a8a96","status":"affected","lessThan":"a421d218603ffa822a0b8045055c03eae394a7eb","versionType":"git"},{"version":"96260bde1ea8ae31a5402fe506abbb8951d5a42c","status":"affected","versionType":"git"},{"version":"5.11.20","status":"affected","lessThan":"5.12","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/pnfs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4.9.269","status":"affected","lessThan":"4.9.271","versionType":"semver"},{"version":"4.14.233","status":"affected","lessThan":"4.14.235","versionType":"semver"},{"version":"4.19.191","status":"affected","lessThan":"4.19.193","versionType":"semver"},{"version":"5.4.118","status":"affected","lessThan":"5.4.124","versionType":"semver"},{"version":"5.10.36","status":"affected","lessThan":"5.10.42","versionType":"semver"},{"version":"5.12.3","status":"affected","lessThan":"5.12.9","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/pnfs.c"]}],"references":["https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42","https://git.kernel.org/stable/c/42637ca25c7d7b5a92804a679af5192e8c1a9f48","https://git.kernel.org/stable/c/39785761feadf261bc5101372b0b0bbaf6a94494","https://git.kernel.org/stable/c/aba3c7795f51717ae316f3566442dee7cc3eeccb","https://git.kernel.org/stable/c/f9890652185b72b8de9ebeb4406037640b6e1b53","https://git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a","https://git.kernel.org/stable/c/a421d218603ffa822a0b8045055c03eae394a7eb"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47179.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47179","state":"PUBLISHED","datePublished":"2024-03-25T09:16:28.787Z","dateUpdated":"2026-08-05T08:46:31.594Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-03-25T09:12:14.112Z"},"containers":{"cna":{"title":"NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()\n\nCommit de144ff4234f changes _pnfs_return_layout() to call\npnfs_mark_matching_lsegs_return() passing NULL as the struct\npnfs_layout_range argument. Unfortunately,\npnfs_mark_matching_lsegs_return() doesn't check if we have a value here\nbefore dereferencing it, causing an oops.\n\nI'm able to hit this crash consistently when running connectathon basic\ntests on NFS v4.1/v4.2 against Ontap."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"80e34f4957ec3010c85f9bb0b568a8d46acdf535","status":"affected","lessThan":"4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42","versionType":"git"},{"version":"7b7b9774643220e53eef58c15bb29bd4182fe053","status":"affected","lessThan":"42637ca25c7d7b5a92804a679af5192e8c1a9f48","versionType":"git"},{"version":"9ffa7967f9379a0a1b924e9ffeda709d72237da7","status":"affected","lessThan":"39785761feadf261bc5101372b0b0bbaf6a94494","versionType":"git"},{"version":"6be0e4b59314e4a836495f6ffdc5d2c5b079deeb","status":"affected","lessThan":"aba3c7795f51717ae316f3566442dee7cc3eeccb","versionType":"git"},{"version":"2fafe7d5047f98791afd9a1d90d2afb70debc590","status":"affected","lessThan":"f9890652185b72b8de9ebeb4406037640b6e1b53","versionType":"git"},{"version":"7e65ea887d0c0997f3053acd91a027af45e71c5b","status":"affected","lessThan":"b090d110e66636bca473fd8b98d5c97b555a965a","versionType":"git"},{"version":"de144ff4234f935bd2150108019b5d87a90a8a96","status":"affected","lessThan":"a421d218603ffa822a0b8045055c03eae394a7eb","versionType":"git"},{"version":"96260bde1ea8ae31a5402fe506abbb8951d5a42c","status":"affected","versionType":"git"},{"version":"5.11.20","status":"affected","lessThan":"5.12","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/pnfs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4.9.269","status":"affected","lessThan":"4.9.271","versionType":"semver"},{"version":"4.14.233","status":"affected","lessThan":"4.14.235","versionType":"semver"},{"version":"4.19.191","status":"affected","lessThan":"4.19.193","versionType":"semver"},{"version":"5.4.118","status":"affected","lessThan":"5.4.124","versionType":"semver"},{"version":"5.10.36","status":"affected","lessThan":"5.10.42","versionType":"semver"},{"version":"5.12.3","status":"affected","lessThan":"5.12.9","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/pnfs.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42"},{"url":"https://git.kernel.org/stable/c/42637ca25c7d7b5a92804a679af5192e8c1a9f48"},{"url":"https://git.kernel.org/stable/c/39785761feadf261bc5101372b0b0bbaf6a94494"},{"url":"https://git.kernel.org/stable/c/aba3c7795f51717ae316f3566442dee7cc3eeccb"},{"url":"https://git.kernel.org/stable/c/f9890652185b72b8de9ebeb4406037640b6e1b53"},{"url":"https://git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a"},{"url":"https://git.kernel.org/stable/c/a421d218603ffa822a0b8045055c03eae394a7eb"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - This is NFSv4/pNFS client code reached while handling layout return after interaction with a remote pNFS MDS/DS peer; a malicious or compromised server can drive the return path (e.g., block/scsi layout I/O errors with PNFS_LAYOUTRET_ON_ERROR, or ordinary layout lifecycle on an active mount).\nAC:L - The crash is a deterministic NULL dereference of the missing layout-range argument and was reported as consistently reproducible on NFSv4.1/4.2 pNFS workloads; the attacker can reliably force layout return once layouts exist.\nPR:N - The attacker can be the remote NFS/pNFS server and needs no privileges on the victim client; client-local credentials are not required for the server-driven trigger.\nUI:N - In a realistic deployment the client already has an active pNFS mount (fstab/automount/infrastructure storage), so exploitation does not require a separate victim action beyond normal use of that mount.\nS:U - Impact is limited to the client kernel/NFS client security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The bug is a pure NULL pointer dereference of return_range with no out-of-bounds read or other information-disclosure primitive.\nI:N - There is no memory write, type confusion, or corruption path—only a NULL dereference—so integrity is unaffected.\nA:H - Dereferencing the NULL layout-range pointer causes a kernel oops/panic in pnfs_mark_matching_lsegs_return(), which is a high availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:46:31.594Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.269","versionEndExcluding":"4.9.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.233","versionEndExcluding":"4.14.235"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.191","versionEndExcluding":"4.19.193"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.118","versionEndExcluding":"5.4.124"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.36","versionEndExcluding":"5.10.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12.3","versionEndExcluding":"5.12.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11.20"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-47179","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-03-25T15:17:57.286141Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-05T17:21:16.888Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/42637ca25c7d7b5a92804a679af5192e8c1a9f48","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/39785761feadf261bc5101372b0b0bbaf6a94494","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/aba3c7795f51717ae316f3566442dee7cc3eeccb","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/f9890652185b72b8de9ebeb4406037640b6e1b53","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/a421d218603ffa822a0b8045055c03eae394a7eb","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T05:32:07.318Z"}}]}}}