Medium 5.5Published Feb 28, 2024

CVE-2021-47002SUNRPC: Fix null pointer dereference in svc_rqst_free()

Updated under an hour ago (Oct 26, 2026, 6:23 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null pointer dereference in svc_rqst_free() When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). Fix it by adding a null check. Addresses-Coverity: ("Dereference after null check")

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	79e4e0d489c8e72b9efa388e504a036eec1550c6 builds before 3de81c1e84bf84803308da3272a829a7655c5336; 5191955d6fc65e6d4efe8f4f10a6028298f57281 builds before 1e10f58f1c9a6b667b045513c7a4e6111c24fe7c; from 5191955d6fc65e6d4efe8f4f10a6028298f57281 before c664aaec9aee544538a78ba4893a44bc73a6d742; from 5191955d6fc65e6d4efe8f4f10a6028298f57281 before b9f83ffaa0c096b4c832a43964fe6bff3acffe10; from 5.10.220 before 5.10.221	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	before 5.10.221; from 5.11 before 5.11.22; from 5.12 before 5.12.5	NVD

References

References

https://git.kernel.org/stable/c/3de81c1e84bf84803308da3272a829a7655c5336	patch
https://git.kernel.org/stable/c/1e10f58f1c9a6b667b045513c7a4e6111c24fe7c	patch
https://git.kernel.org/stable/c/c664aaec9aee544538a78ba4893a44bc73a6d742	patch
https://git.kernel.org/stable/c/b9f83ffaa0c096b4c832a43964fe6bff3acffe10	patch
https://cert-portal.siemens.com/productcert/html/ssa-265688.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.