Security readout for executives and security teams
Plain-English summary
CVE-2021-47006 is a Linux kernel ARM bug in hardware breakpoint handling. A local user could trigger an availability impact, but the public record shows no confidentiality or integrity impact and no active exploitation evidence. Treat this as a kernel maintenance risk for ARM systems, not an internet-facing emergency.
Executive priority
Schedule remediation through normal kernel patch cycles, with faster handling for shared ARM systems or devices exposed to local users. Business urgency is moderate because impact is availability-only and local, with no sourced evidence of exploitation.
Technical view
The ARM hw_breakpoint code directly checked the perf event overflow_handler hook after perf changed events to always receive a default handler. Because the handler could no longer be NULL, enable_single_step() was skipped. The CVSS vector is local, low complexity, low privilege, no user interaction, availability high.
Likely exposure
Exposure is most likely on ARM Linux systems running affected kernel versions identified in the CVE record, including affected 4.x and 5.x stable lines up to 5.13. Non-ARM deployments are not supported as affected by the supplied evidence.
Exploitation context
The supplied sources do not show KEV listing or public active exploitation. Exploitation requires local access with low privileges, and the documented impact is denial of service or availability loss rather than data theft or code execution.
Researcher notes
This issue stems from an incomplete API-behavior update after perf began assigning a default overflow_handler. The interesting validation point is whether ARM hw_breakpoint logic checks for the default handler instead of assuming NULL means absent. Evidence is limited to CVE data and kernel stable references.
Mitigation direction
- Apply a vendor kernel update containing the relevant stable fix for your kernel line.
- Prioritize ARM Linux hosts where local untrusted users can run code.
- Check distribution advisories before backporting kernel commits manually.
- Restart into the patched kernel after maintenance approval.
- Track this as availability hardening, not an emergency internet-facing patch.
Validation and detection
- Inventory ARM Linux kernel versions across servers, appliances, and embedded devices.
- Map each kernel to the affected versions and referenced stable commits.
- Confirm the installed kernel package includes CVE-2021-47006 or its stable fix.
- Verify the patched code uses the default overflow-handler check correctly.
- Review uptime and crash telemetry for unexplained local availability events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47006 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/555a70f7fff03bd669123487905c47ae27dbdaacCVE reference, Linux
- https://git.kernel.org/stable/c/ed1f67465327cec4457bb988775245b199da86e6CVE reference, Linux
- https://git.kernel.org/stable/c/a9938d6d78a238d6ab8de57a4d3dcf77adceb9bbCVE reference, Linux
- https://git.kernel.org/stable/c/3ed8832aeaa9a37b0fc386bb72ff604352567c80CVE reference, Linux
- https://git.kernel.org/stable/c/630146203108bf6b8934eec0dfdb3e46dcb917deCVE reference, Linux
- https://git.kernel.org/stable/c/7eeacc6728c5478e3c01bc82a1f08958eaa12366CVE reference, Linux
- https://git.kernel.org/stable/c/dabe299425b1a53a69461fed7ac8922ea6733a25CVE reference, Linux
- https://git.kernel.org/stable/c/a506bd5756290821a4314f502b4bafc2afcf5260CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.