LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47017: ath10k: Fix a use after free in ath10k_htc_send_bundle

In the Linux kernel, the following vulnerability has been resolved: ath10k: Fix a use after free in ath10k_htc_send_bundle In ath10k_htc_send_bundle, the bundle_skb could be freed by dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later by bundle_skb->len. As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to skb_len after the bundle_skb was freed.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel bug in the ath10k wireless driver. A memory buffer can be freed and then referenced later, which may cause instability or security impact on affected systems. The source bundle does not provide CVSS, confirmed exploitation, or a detailed impact statement.

Executive priority

Treat as a kernel maintenance priority, not an emergency, unless ath10k-dependent systems are business-critical or exposed in sensitive environments. The lack of CVSS and exploitation evidence limits urgency assessment.

Technical view

ath10k_htc_send_bundle may call dev_kfree_skb_any(bundle_skb) and later read bundle_skb->len. The kernel fix replaces the post-free dereference with the previously saved skb_len value. Affected evidence points to Linux kernel stable branches around 5.8 through 5.13, subject to vendor backports.

Likely exposure

Exposure is most likely on systems running affected Linux kernel builds where the ath10k driver is present and used. Confirm through kernel package version, distro backport notes, and hardware or module inventory.

Exploitation context

The provided sources do not show active exploitation, and KEV is false. The issue is a kernel use-after-free, but the bundle does not establish exploitability, required privileges, attack path, or public exploit availability.

Researcher notes

Key unknowns are exploitability, trigger conditions, and impact. Analysis should focus on the patched ath10k_htc_send_bundle path and whether reachable deployments can exercise bundle_skb freeing before later length use.

Mitigation direction

  • Apply vendor kernel updates containing the referenced stable fixes.
  • Verify distro backport status before relying on upstream version numbers.
  • Prioritize systems using the ath10k driver or related wireless hardware.
  • Track this CVE in normal kernel vulnerability management until closed.

Validation and detection

  • Inventory running kernel versions across Linux assets.
  • Check whether ath10k is present, loaded, or required.
  • Compare installed packages with vendor advisories and changelogs.
  • Confirm the patched kernel is installed and booted.
  • Document exceptions where vendor fix status is unclear.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47017 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc8334512f3dd1b94844baca629f9bedca4271593, c8334512f3dd1b94844baca629f9bedca4271593, c8334512f3dd1b94844baca629f9bedca4271593, c8334512f3dd1b94844baca629f9bedca4271593unaffected
LinuxLinux5.8, 0, 5.10.37, 5.11.21, 5.12.4, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.