Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw affects a specialized virtualization path, vhost-vdpa. Missing memory-mapping flags for a virtqueue doorbell could let a userspace mapping attempt trigger a kernel panic. The available sources describe a reliability and availability risk, not data theft or confirmed active exploitation.
Executive priority
Handle through normal kernel patch governance, with higher priority for virtualization infrastructure using vDPA. There is no sourced evidence of active exploitation, but kernel panic risk can still affect service availability.
Technical view
vhost-vdpa did not set required VMA flags, including VM_PFNMAP, for virtqueue doorbell mappings. Because the doorbell may be register-backed rather than page-backed, vhost IOTLB mapping could touch memory without a page structure and panic the kernel. The fix makes such mapping fail with a bad address.
Likely exposure
Exposure is most likely on Linux kernels in the affected range where vhost-vdpa or vDPA-backed virtualization is enabled. General Linux systems not using this subsystem appear less exposed, based on the source description.
Exploitation context
The source bundle does not show CISA KEV listing, public exploitation, exploit code, or weaponized details. The described impact is a kernel panic through a userspace mapping path, so treat it as a potential denial-of-service issue until vendor guidance says otherwise.
Researcher notes
The evidence is limited to the CVE record and Linux stable commit references. No CVSS, CWE, proof of concept, or distribution-specific affected package matrix is provided in the bundle, so validation should be kernel-branch and vendor-advisory driven.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Prioritize virtualization hosts using vhost-vdpa or vDPA devices.
- Check distribution advisories for backported fixes and exact package versions.
- Avoid unsupported workaround assumptions; follow vendor guidance for temporary controls.
Validation and detection
- Inventory Linux kernel versions across virtualization hosts.
- Identify systems using vhost-vdpa or vDPA functionality.
- Compare installed kernels against vendor fixed versions or referenced stable commits.
- Confirm the CVE is not listed in CISA KEV before claiming active exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-46967 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6CVE reference, Linux
- https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7CVE reference, Linux
- https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ceCVE reference, Linux
- https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.