CVE-2021-47188 in Linux
Summary
by MITRE • 04/10/2024
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Improve SCSI abort handling
The following has been observed on a test setup:
WARNING: CPU: 4 PID: 250 at drivers/scsi/ufs/ufshcd.c:2737 ufshcd_queuecommand+0x468/0x65c Call trace: ufshcd_queuecommand+0x468/0x65c scsi_send_eh_cmnd+0x224/0x6a0 scsi_eh_test_devices+0x248/0x418 scsi_eh_ready_devs+0xc34/0xe58 scsi_error_handler+0x204/0x80c kthread+0x150/0x1b4 ret_from_fork+0x10/0x30
That warning is triggered by the following statement:
WARN_ON(lrbp->cmd);
Fix this warning by clearing lrbp->cmd from the abort handler.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability described in CVE-2021-47188 resides within the Linux kernel's Universal Flash Storage (UFS) subsystem, specifically in the SCSI core component that manages UFS host controller communications. This issue manifests as a kernel warning triggered during SCSI command abort operations, representing a potential stability concern that could impact system reliability when handling UFS storage devices. The vulnerability affects the ufshcd.c driver file where the UFS host controller driver implements its command queueing and abort handling mechanisms.
The technical flaw occurs in the SCSI abort handling code path where a warning is generated when attempting to abort a command that has already been processed or cleared. The kernel warning specifically originates from line 2737 in the ufshcd.c file within the ufshcd_queuecommand function, indicating that the lrpb->cmd pointer is not properly cleared after command abort operations. This represents a classic race condition or improper state management issue where the command structure reference remains valid despite the command being in the process of aborting or has already completed execution. The warning is triggered by the statement WARN_ON(lrbp->cmd) which essentially validates that the command pointer should be NULL after abort operations but is found to contain a valid reference.
The operational impact of this vulnerability extends beyond simple warning messages as it could potentially lead to system instability or unexpected behavior when UFS storage devices encounter error conditions requiring command aborts. When the SCSI error handling subsystem attempts to manage device errors and execute command aborts, the improper clearing of command references can cause the kernel to detect an inconsistent state, potentially leading to system crashes or lockups. This is particularly concerning in production environments where UFS storage is heavily utilized and error recovery mechanisms are frequently exercised. The vulnerability affects the broader SCSI error handling framework and could compound other UFS-related issues when multiple error conditions occur in rapid succession.
The fix implemented addresses this issue by ensuring that the lrbp->cmd field is properly cleared within the abort handler before the warning condition is evaluated. This aligns with established security practices for proper resource management and state cleanup in kernel drivers. The solution follows the principle of defensive programming where all references to potentially freed or invalid structures are cleared to prevent accidental reuse. This remediation directly addresses the root cause identified in the call trace showing the sequence from ufshcd_queuecommand through the SCSI error handling subsystem, ensuring that command abort operations properly clean up their internal references. The fix demonstrates proper memory management practices and aligns with the principle that kernel drivers should maintain consistent internal state throughout their execution lifecycle. This vulnerability and its resolution are consistent with common patterns found in kernel security issues related to improper resource management and state consistency, which are categorized under CWE-691 and related to ATT&CK techniques involving system stability compromise and privilege escalation through kernel vulnerabilities.