Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash a system in a specific PCI endpoint test path when the platform driver does not provide expected endpoint feature data. The source describes a NULL pointer dereference, not data theft or remote code execution. Business urgency depends on whether the kernel and PCI endpoint functionality are present in deployed devices.
Executive priority
Prioritize for embedded or hardware-facing Linux fleets where PCI endpoint functionality is used. For ordinary workloads without this feature, handle through normal kernel patch management unless vendor guidance raises urgency.
Technical view
CVE-2021-47005 fixes a NULL pointer dereference in the Linux PCI endpoint framework. pci_epc_ops->get_features() may return NULL, and pci_epf_test_bind accessed that pointer before checking it. The fix adds a NULL check and returns -ENOTSUPP when endpoint controller features are unavailable.
Likely exposure
Likely limited to Linux systems using PCI endpoint controller functionality and the endpoint test function, especially embedded, ARM64, or hardware-validation environments. General-purpose servers without PCI endpoint mode are less likely to be exposed based on the provided evidence.
Exploitation context
The bundle provides a kernel call trace triggered through configfs symlink handling, but no KEV listing, public exploitation claim, CVSS score, or proof of malicious exploitation. Treat active exploitation as unconfirmed.
Researcher notes
Evidence supports a reliability-impact kernel NULL dereference in a narrow PCI endpoint code path. The provided data does not establish privilege requirements, attacker reachability, CVSS impact, or exploitation in the wild. Validate exposure against actual kernel config, platform driver behavior, and backported patches.
Mitigation direction
- Identify kernels matching the affected Linux version ranges in the CVE bundle.
- Apply vendor or distribution kernel updates containing the linked stable fixes.
- If patching is delayed, restrict access to PCI endpoint configuration interfaces.
- Check vendor guidance for platform-specific mitigation or backport status.
Validation and detection
- Confirm whether deployed kernels include the referenced stable commits or vendor backports.
- Inventory systems that enable PCI endpoint controller and endpoint test functionality.
- Review kernel logs for NULL pointer dereference traces involving pci_epf_test_bind.
- Verify configfs access is limited to trusted administrators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47005 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/bbed83d7060e07a5d309104d25a00f0a24441428CVE reference, Linux
- https://git.kernel.org/stable/c/679ebad058b8168f10e63876d63b0877fd2fe784CVE reference, Linux
- https://git.kernel.org/stable/c/0169d4f0bee44fdfef908c13ed21fcb326c38695CVE reference, Linux
- https://git.kernel.org/stable/c/6613bc2301ba291a1c5a90e1dc24cf3edf223c03CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.