CVE-2021-47582: 
Linux Kernel vulnerability analysis and mitigation

The vulnerability CVE-2021-47582 affects the Linux kernel's USB core subsystem. The issue involves the USBDEVFSCONTROL and USBDEVFSBULK ioctls which invoke usbstartwait_urb() containing an uninterruptible wait with a user-specified timeout value. This vulnerability was discovered and disclosed in 2021 (Kernel Git).

The vulnerability occurs when a large timeout value is specified and the accessed device does not respond in a reasonable timeframe. This results in the kernel complaining about 'Task X blocked for more than N seconds'. The issue specifically manifests in the doproccontrol() and doprocbulk() functions within the USB core subsystem (Kernel Git).

When exploited, this vulnerability can cause tasks to become blocked for extended periods, potentially leading to system responsiveness issues. The blocking condition occurs in an uninterruptible state, meaning the task cannot be killed or interrupted until the timeout expires or the device responds (NVD).

The issue has been fixed by replacing usbfs's calls to usbcontrolmsg() and usbbulkmsg() with special-purpose code that uses a killable wait and GFPKERNEL rather than GFPNOIO. The fix has been implemented in the Linux kernel and is available through various distribution updates (Kernel Git).