Read the docs
TI-2021-21888 Aliases CVE-2021-47229GHSA-74hg-7r85-vvw3

PCI: aardvark: Fix kernel panic during PIO transfer

Priority LOW 24Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In the Linux kernel, the following vulnerability has been resolved: PCI: aardvark: Fix kernel panic during PIO transfer Trying to start a new PIO transfer by writing value 0 in PIO_START register when previous transfer has not yet completed (which is indicated by value 1 in PIO_START) causes an External Abort on CPU, which results in kernel panic: SError Interrupt on CPU0, code 0xbf000002 -- SError Kernel panic - not syncing: Asynchronous SError Interrupt To prevent kernel panic, it is required to reject a new PIO transfer when previous one has not finished yet. If previous PIO transfer is not finished yet, the kernel may issue a new PIO request only if the previous PIO transfer timed out. In the past the root cause of this issue was incorrectly identified (as it often happens during link retraining or after link down event) and special hack was implemented in Trusted Firmware to catch all SError events in EL3, to ignore errors with code 0xbf000002 and not forwarding any other errors to kernel and instead throw panic from EL3 Trusted Firmware handler. Links to discussion and patches about this issue: https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=3c7dcdac5c50 https://lore.kernel.org/linux-pci/[email protected]/ https://lore.kernel.org/linux-pci/[email protected]/ https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/1541 But the real cause was the fact that during link retraining or after link down event the PIO transfer may take longer time, up to the 1.44s until it times out. This increased probability that a new PIO transfer would be issued by kernel while previous one has not finished yet. After applying this change into the kernel, it is possible to revert the mentioned TF-A hack and SError events do not have to be caught in TF-A EL3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00226 13th percentileScored 2026-11-07
Fix Fixed Linux (Linux): 4.14.240, 4.19.198, 5.4.128 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux4.8 and later4.14.240, 4.19.198, 5.4.128, 5.10.46, 5.12.13, 5.13Patch availableCNA
  • Linux VendorLinux Affected 4.8 and later Fixed in 4.14.240, 4.19.198, 5.4.128, 5.10.46, 5.12.13, 5.13 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*before 4.14.240; 4.15 to before 4.19.198; 4.20 to before 5.4.128; 5.5 to before 5.10.46; 5.11 to before 5.12.13VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*5.13 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*5.13 rc2VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*5.13 rc3VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*5.13 rc4VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*5.13 rc5VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*5.13 rc6VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 4.14.240; 4.15 to before 4.19.198; 4.20 to before 5.4.128; 5.5 to before 5.10.46; 5.11 to before 5.12.13 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:* Versions 5.13 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:* Versions 5.13 rc2 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:* Versions 5.13 rc3 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:* Versions 5.13 rc4 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:* Versions 5.13 rc5 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:* Versions 5.13 rc6 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 4.14.240, 4.19.198, 5.4.128, 5.10.46, 5.12.13, 5.13

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-47229
  2. 2026-10-03 Alias added: GHSA-74hg-7r85-vvw3

References

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources