Answer in brief
CVE-2021-47636 records a High severity (CVSS 7.1) vulnerability in ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d <5343575aa11c5d7044107d59d43f84aec01312b0 || >=1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d <b80ccbec0e4804436c382d7dd60e943c386ed83a || >=1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d <07a209fadee7b53b46858538e1177597273862e4 || >=1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d <a7054aaf1909cf40489c0ec1b728fdcf79c751a6 || >=1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d <e09fa5318d51f522e1af4fbaf8f74999355980c8 || >=1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d <3b7fb89135a20587d57f8877c02e25003e9edbdf || >=1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d <4f2262a334641e05f645364d5ade1f565c85f20b | 5343575aa11c5d7044107d59d43f84aec01312b0, b80ccbec0e4804436c382d7dd60e943c386ed83a, 07a209fadee7b53b46858538e1177597273862e4, a7054aaf1909cf40489c0ec1b728fdcf79c751a6, e09fa5318d51f522e1af4fbaf8f74999355980c8, 3b7fb89135a20587d57f8877c02e25003e9edbdf, 4f2262a334641e05f645364d5ade1f565c85f20b |
| Linux/Linuxgeneric | 2.6.27 | Not reported |
Published upstream
Feb 26, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() Function ubifs_wbuf_write_nolock() may access buf out of bounds in following process: ubifs_wbuf_write_nolock(): aligned_len = ALIGN(len, 8); // Assume len = 4089, aligned_len = 4096 if (aligned_len <= wbuf->avail) ... // Not satisfy if (wbuf->used) { ubifs_leb_write() // Fill some data in avail wbuf len -= wbuf->avail; // len is still not 8-bytes aligned aligned_len -= wbuf->avail; } n = aligned_len >> c->max_write_shift; if (n) { n <<= c->max_write_shift; err = ubifs_leb_write(c, wbuf->lnum, buf + written, wbuf->offs, n); // n > len, read out of bounds less than 8(n-len) bytes } , which can be catched by KASAN: ========================================================= BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0 Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128 Workqueue: writeback wb_workfn (flush-ubifs_0_0) Call Trace: kasan_report.cold+0x81/0x165 nand_write_page_swecc+0xa9/0x160 ubifs_leb_write+0xf2/0x1b0 [ubifs] ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs] write_head+0xdc/0x1c0 [ubifs] ubifs_jnl_write_inode+0x627/0x960 [ubifs] wb_workfn+0x8af/0xb80 Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8 bytes aligned, the 'len' represents the true length of buf (which is allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully to write leb safely. Fetch a reproducer in [Link].
Quoted source text, attributed separately from HOL analysis.