What is CVE-2021-47434?

CVE-2021-47434 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10. CVE-2021-47434 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2021-47434?

CVE-2021-47434 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2021-47434?

No patch is currently available for CVE-2021-47434. Monitor the NIST NVD and your Linux distribution's security advisories for updates.

Is CVE-2021-47434 actively exploited?

CVE-2021-47434 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2021-47434

Medium

In the Linux kernel, the following vulnerability has been resolved: xhci: Fix command ring pointer corruption while aborting a command The command ring pointer is located at [6:63] bits of the command ring control register (CRCR). All the control bits like command stop, abort are located at [0:3] bits. While aborting a command, we read the CRCR and set the abort bit and write to the CRCR. The read will always give command ring pointer as all zeros. So we essentially write only the control bits. Since we split the 64 bit write into two 32 bit writes, there is a possibility of xHC command ring stopped before the upper dword (all zeros) is written. If that happens, xHC updates the upper dword of its internal command ring pointer with all zeros. Next time, when the command ring is restarted, we see xHC memory access failures. Fix this issue by only writing to the lower dword of CRCR where all control bits are located.

Package Linux Kernel

Published 2024-05-22

Last modified 2025-09-25

CVSS version 3.1

Patch available

Awaiting data

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

The following references provide additional information about CVE-2021-47434 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

Kernel patch commit
https://git.kernel.org/stable/c/01c2dcb67e71c351006dd17cbba86c26b7f61eaf
Patch
Kernel patch commit
https://git.kernel.org/stable/c/22bcb65ea41072ab5d03c0c6290e04e0df6d09a0
Patch
Kernel patch commit
https://git.kernel.org/stable/c/62c182b5e763e5f4062e72678e72ce3e02dd4d1b
Patch

6 patch commits total View all on NVD

Details

CVE ID CVE-2021-47434

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2024-05-22

Modified 2025-09-25

KEV No

Patch Awaiting data

Package linux

Frequently asked questions

What is CVE-2021-47434?

CVE-2021-47434 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . CVE-2021-47434 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2021-47434?

CVE-2021-47434 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2021-47434?

No patch is currently available for CVE-2021-47434. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
Is CVE-2021-47434 actively exploited?

No — CVE-2021-47434 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.