CVE-2021-47493 – This is a race condition vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2021-47493?

CVE-2021-47493 has a CVSS score of 4.7 (MEDIUM). This is a race condition vulnerability in the Linux kernel's OCFS2 filesystem driver that can cause a kernel panic and system crash. It affects systems using OCFS2 filesystems when concurrent operations access buffer heads while journal heads are being released. The vulnerability requires local access to trigger.

📋 TL;DR

This is a race condition vulnerability in the Linux kernel's OCFS2 filesystem driver that can cause a kernel panic and system crash. It affects systems using OCFS2 filesystems when concurrent operations access buffer heads while journal heads are being released. The vulnerability requires local access to trigger.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific kernel versions with OCFS2 support before the fix commits

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when OCFS2 filesystem is in use. Most systems don't use OCFS2 by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data corruption or loss in OCFS2 filesystems.

🟠

Likely Case

System crash or kernel panic when specific race conditions occur during OCFS2 filesystem operations, resulting in temporary denial of service.

🟢

If Mitigated

No impact if systems don't use OCFS2 filesystems or have patched kernels.

🌐 Internet-Facing: LOW - Requires local access to trigger, not remotely exploitable.

🏢 Internal Only: MEDIUM - Local users or processes can cause system crashes affecting shared infrastructure.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH - Requires precise timing to trigger race condition

Exploitation requires local access and specific conditions to trigger the race condition.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 2e382600e8856ea654677b5134ee66e03ea72bc2, 5043fbd294f5909a080ade0f04b70a4da9e122b7, or 6f1b228529ae49b0f85ab89bcdb6c365df401558

Vendor Advisory: https://git.kernel.org/stable/c/2e382600e8856ea654677b5134ee66e03ea72bc2

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution for specific kernel package updates. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable OCFS2 module

linux

Prevent loading of OCFS2 kernel module if not needed

echo 'install ocfs2 /bin/false' >> /etc/modprobe.d/disable-ocfs2.conf
rmmod ocfs2

Avoid OCFS2 filesystem usage

linux

Use alternative filesystems instead of OCFS2

🧯 If You Can't Patch

Restrict local user access to systems using OCFS2
Monitor for kernel panic events and OCFS2-related crashes

🔍 How to Verify

Check if Vulnerable:

Check if OCFS2 module is loaded: lsmod | grep ocfs2 AND check kernel version against affected versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits: grep -q '2e382600e8856ea654677b5134ee66e03ea72bc2\|5043fbd294f5909a080ade0f04b70a4da9e122b7\|6f1b228529ae49b0f85ab89bcdb6c365df401558' /proc/version_signature

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
OCFS2-related crash dumps
System crash/reboot events

Network Indicators:

None - local vulnerability only

SIEM Query:

event_type:kernel_panic AND (process:ocfs2 OR module:ocfs2)

📊 Metadata

CVE ID: CVE-2021-47493

CVSS v3 Score: 4.7 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-362

Published: May 22, 2024

Last Updated: September 24, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47493, you might also want to check these: