LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47493: ocfs2: fix race between searching chunks and release journal_head from buffer_head

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix race between searching chunks and release journal_head from buffer_head Encountered a race between ocfs2_test_bg_bit_allocatable() and jbd2_journal_put_journal_head() resulting in the below vmcore. PID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: "loop3" Call trace: panic oops_end no_context __bad_area_nosemaphore bad_area_nosemaphore __do_page_fault do_page_fault page_fault [exception RIP: ocfs2_block_group_find_clear_bits+316] ocfs2_block_group_find_clear_bits [ocfs2] ocfs2_cluster_group_search [ocfs2] ocfs2_search_chain [ocfs2] ocfs2_claim_suballoc_bits [ocfs2] __ocfs2_claim_clusters [ocfs2] ocfs2_claim_clusters [ocfs2] ocfs2_local_alloc_slide_window [ocfs2] ocfs2_reserve_local_alloc_bits [ocfs2] ocfs2_reserve_clusters_with_limit [ocfs2] ocfs2_reserve_clusters [ocfs2] ocfs2_lock_refcount_allocators [ocfs2] ocfs2_make_clusters_writable [ocfs2] ocfs2_replace_cow [ocfs2] ocfs2_refcount_cow [ocfs2] ocfs2_file_write_iter [ocfs2] lo_rw_aio loop_queue_work kthread_worker_fn kthread ret_from_fork When ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the bg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and released the jounal head from the buffer head. Needed to take bit lock for the bit 'BH_JournalHead' to fix this race.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel reliability vulnerability in OCFS2, a cluster filesystem. A race condition can cause a kernel page fault and panic during filesystem write/allocation paths. Business impact is likely service disruption on systems using OCFS2, not confirmed data theft or remote compromise from the provided sources.

Executive priority

Treat as a targeted stability risk. Prioritize clustered storage or workloads using OCFS2 because a kernel panic can interrupt service. Broader emergency response is not supported without evidence of active exploitation or remote attackability.

Technical view

OCFS2 can race between ocfs2_test_bg_bit_allocatable() and jbd2_journal_put_journal_head(). The journal head can be released from a buffer_head while OCFS2 expects it, leaving bg_bh->b_private NULL and causing a crash in ocfs2_block_group_find_clear_bits(). The fix takes the BH_JournalHead bit lock.

Likely exposure

Exposure is most relevant to Linux hosts that use or mount OCFS2, especially kernels in affected ranges identified by the CVE record. Systems not using OCFS2 are less likely to be practically exposed, though distro backports must be checked.

Exploitation context

The provided sources describe a race-triggered kernel panic and do not state active exploitation. The CVE is not listed as KEV in the supplied bundle. No public exploit status is supported by the provided evidence.

Researcher notes

Evidence supports a kernel race in OCFS2 journal-head handling leading to NULL dereference/panic. The source bundle lacks CVSS, CWE, exploitability details, and distribution-specific fixed versions. Avoid assuming impact beyond denial of service unless vendor advisories add more detail.

Mitigation direction

  • Apply Linux kernel or vendor updates containing the referenced OCFS2 fix.
  • Prioritize hosts that mount OCFS2 or load the ocfs2 module.
  • Check distribution advisories for backported fixed kernel packages.
  • If patching is delayed, review vendor guidance for operational workarounds.

Validation and detection

  • Inventory Linux kernel versions across systems using OCFS2.
  • Confirm whether the ocfs2 module is loaded or OCFS2 filesystems are mounted.
  • Verify the running kernel includes the referenced stable fix commits or vendor backports.
  • Review crash logs for ocfs2_block_group_find_clear_bits or related OCFS2 panic traces.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47493 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxccd979bdbce9fba8412beb3f1de68a9d0171b12c, ccd979bdbce9fba8412beb3f1de68a9d0171b12c, ccd979bdbce9fba8412beb3f1de68a9d0171b12cunaffected
LinuxLinux2.6.16, 0, 5.10.77, 5.14.16, 5.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.