CVE-2021-47600

A flaw was found in the Linux kernel's device-mapper subsystem. A local user could exploit this vulnerability to cause a Denial of Service (DoS) or potentially execute arbitrary code. The issue is caused by a use-after-free condition during B-tree node removal operations in the rebalance_children() function, where resources are unlocked before reference counts are decremented.

This vulnerability is rated Low severity because triggering the issue requires local administrative privileges (such as root or CAP_SYS_ADMIN) to manage device-mapper persistent-data structures, limiting the attack surface. Standard Red Hat Enterprise Linux configurations do not grant unprivileged users access to manipulate device-mapper metadata or trigger B-tree rebalancing operations. Consequently, the flaw cannot be leveraged for privilege escalation and primarily presents a localized denial-of-service risk for already privileged contexts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.