CVE-2021-47412

What it actually does

Use-after-free in rq_qos framework when rq_qos_done_bio() is invoked on untracked bios or bio-based drivers, dereferencing a potentially freed request queue or q->rq_qos structure during bio_endio().

Why it matters to the business

Unexpected kernel panics and system crashes on Linux hosts performing block I/O, leading to downtime for storage-dependent workloads and services.

How an attack unfolds

An attacker triggers I/O completion paths in error-handling code or bio-based drivers to invoke rq_qos_done_bio() without a tracked request, causing the kernel to reference freed memory and panic; no named threat actors or ransomware campaigns are associated.

How to fix it

Update the Linux kernel to a version containing the fix that skips rq_qos_ops->done_bio calls for untracked bios; apply the patch from the block layer commit resolving CVE-2021-47412.

How to confirm the fix worked

Confirm the kernel source contains the check preventing rq_qos_done_bio() on untracked bios, then exercise bio completion paths under error and bio-based driver conditions to verify absence of panic.

Typical attack path

1. Craft or induce I/O operations that complete via error paths or bio-based drivers
2. Ensure the bio is not tracked by rq_qos
3. Force bio_endio() to call rq_qos_done_bio()
4. Trigger dereference of freed queue or rq_qos structures resulting in panic

How to detect it

Inspect kernel logs and panic dumps for stack traces referencing rq_qos_done_bio, __rq_qos_done_bio, bio_endio, or blk_cleanup_queue; correlate with I/O error paths or bio-based driver activity.

• rq_qos_done_bio
• __rq_qos_done_bio
• bio_endio
• blk_cleanup_queue

What your security team should do

• Prioritize kernel updates on systems with heavy block I/O workloads
• Enable kernel panic logging and monitoring for block-layer stack traces
• Review downstream package distributions for backported fixes