Security readout for executives and security teams
Plain-English summary
CVE-2021-47097 is a Linux kernel driver bug in Elantech touchpad handling. A small stack buffer was used where the lower PS/2 command path reads three bytes. The public record shows a KASAN-detected stack out-of-bounds read during device initialization, not confirmed real-world exploitation.
Executive priority
Handle through normal kernel maintenance, with priority for managed Linux laptops and workstations using Elantech touchpads. This is not evidenced as actively exploited, but it is kernel memory-safety debt and should not remain unpatched indefinitely.
Technical view
The issue is in elantech_change_report_id() in the Linux psmouse Elantech code. param[] was defined as two bytes, but elantech_read_reg_params() calls ps2_command() with PSMOUSE_CMD_GETINFO, which accesses three bytes. Kernel stable commits are referenced as the resolution.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with Elantech PS/2 touchpad or trackpoint hardware using the psmouse driver path. Server exposure is likely limited unless such input hardware or driver paths are present.
Exploitation context
The source bundle does not report active exploitation, and KEV is false. Evidence shows a KASAN finding on a Lenovo system during serio/psmouse device probing. No public source here proves remote exploitability or a practical privilege-escalation path.
Researcher notes
The provided record supports a stack out-of-bounds read, not a complete exploitability assessment. The affected-version data is sparse and branch-specific, so validation should rely on distro kernel advisories or commit presence rather than version strings alone.
Mitigation direction
- Update to a vendor-supported Linux kernel containing the referenced stable fixes.
- Check distribution advisories for the exact fixed kernel package for your branch.
- Prioritize laptops and endpoints with Elantech PS/2 touchpad hardware.
- If patch timing is constrained, follow vendor guidance for temporary risk reduction.
Validation and detection
- Inventory Linux kernel versions across endpoint and laptop fleets.
- Identify systems using Elantech PS/2 input devices or the psmouse driver path.
- Confirm the running kernel includes the referenced stable fix for this CVE.
- Review kernel logs for KASAN or psmouse initialization errors on affected hardware.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47097 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a7f95328c6f0afffdc4555f16e3bbab8bbf0d9beCVE reference, Linux
- https://git.kernel.org/stable/c/676c572439e58b7ee6b7ca3f1e5595382921045cCVE reference, Linux
- https://git.kernel.org/stable/c/dfd5b60b5342b6b505a104e48f08ad9b9bdbbd7bCVE reference, Linux
- https://git.kernel.org/stable/c/1d72d9f960ccf1052a0630a68c3d358791dbdaaaCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.