Answer in brief
CVE-2021-47412 records a High severity (CVSS 7.8) vulnerability in block: don't call rq_qos_ops->done_bio if the bio isn't tracked. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 <db60edbfff332a6a5477c367af8125f034570989 || >=67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 <004b8f8a691205a93d9e80d98b786b2b97424d6e || >=67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 <a647a524a46736786c95cdb553a070322ca096e3 | db60edbfff332a6a5477c367af8125f034570989, 004b8f8a691205a93d9e80d98b786b2b97424d6e, a647a524a46736786c95cdb553a070322ca096e3 |
| Linux/Linuxgeneric | 4.19 | Not reported |
Published upstream
May 21, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
In the Linux kernel, the following vulnerability has been resolved: block: don't call rq_qos_ops->done_bio if the bio isn't tracked rq_qos framework is only applied on request based driver, so: 1) rq_qos_done_bio() needn't to be called for bio based driver 2) rq_qos_done_bio() needn't to be called for bio which isn't tracked, such as bios ended from error handling code. Especially in bio_endio(): 1) request queue is referred via bio->bi_bdev->bd_disk->queue, which may be gone since request queue refcount may not be held in above two cases 2) q->rq_qos may be freed in blk_cleanup_queue() when calling into __rq_qos_done_bio() Fix the potential kernel panic by not calling rq_qos_ops->done_bio if the bio isn't tracked. This way is safe because both ioc_rqos_done_bio() and blkcg_iolatency_done_bio() are nop if the bio isn't tracked.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2021-47412 records a High severity (CVSS 7.8) vulnerability in block: don't call rq_qos_ops->done_bio if the bio isn't tracked. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 <db60edbfff332a6a5477c367af8125f034570989 || >=67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 <004b8f8a691205a93d9e80d98b786b2b97424d6e || >=67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 <a647a524a46736786c95cdb553a070322ca096e3 | db60edbfff332a6a5477c367af8125f034570989, 004b8f8a691205a93d9e80d98b786b2b97424d6e, a647a524a46736786c95cdb553a070322ca096e3 |
| Linux/Linuxgeneric | 4.19 | Not reported |
Published upstream
May 21, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
In the Linux kernel, the following vulnerability has been resolved: block: don't call rq_qos_ops->done_bio if the bio isn't tracked rq_qos framework is only applied on request based driver, so: 1) rq_qos_done_bio() needn't to be called for bio based driver 2) rq_qos_done_bio() needn't to be called for bio which isn't tracked, such as bios ended from error handling code. Especially in bio_endio(): 1) request queue is referred via bio->bi_bdev->bd_disk->queue, which may be gone since request queue refcount may not be held in above two cases 2) q->rq_qos may be freed in blk_cleanup_queue() when calling into __rq_qos_done_bio() Fix the potential kernel panic by not calling rq_qos_ops->done_bio if the bio isn't tracked. This way is safe because both ioc_rqos_done_bio() and blkcg_iolatency_done_bio() are nop if the bio isn't tracked.
Quoted source text, attributed separately from HOL analysis.