LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47110: x86/kvm: Disable kvmclock on all CPUs on shutdown

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Disable kvmclock on all CPUs on shutdown Currenly, we disable kvmclock from machine_shutdown() hook and this only happens for boot CPU. We need to disable it for all CPUs to guard against memory corruption e.g. on restore from hibernate. Note, writing '0' to kvmclock MSR doesn't clear memory location, it just prevents hypervisor from updating the location so for the short while after write and while CPU is still alive, the clock remains usable and correct so we don't need to switch to some other clocksource.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel KVM clock shutdown bug. During shutdown, only the boot CPU disabled kvmclock, leaving other CPUs able to be updated by the hypervisor. The stated risk is memory corruption, especially around restore from hibernate. No public source in the bundle shows active exploitation.

Executive priority

Treat as a patch-management priority for virtualized Linux fleets, not as an emergency internet-exposed issue based on the provided evidence. Prioritize systems with hibernation, restore, or sensitive workloads where kernel memory corruption has higher operational impact.

Technical view

The machine_shutdown() path disabled kvmclock only on the boot CPU. The fix disables kvmclock on all CPUs, preventing hypervisor updates to stale memory locations after shutdown handling. The source specifically cites memory corruption on hibernate restore as an example impact.

Likely exposure

Exposure is most relevant to Linux systems running as KVM guests with kvmclock enabled, particularly where hibernate or restore workflows exist. The bundle lists Linux kernel versions and stable commit references, but does not provide distribution-specific package names or CVSS scoring.

Exploitation context

The source bundle does not identify exploit activity, KEV listing, public exploit code, or remote attack paths. The evidence supports a kernel memory-corruption condition tied to KVM clock handling during shutdown and hibernate restore paths.

Researcher notes

The public description is concise and lacks CVSS, CWE, exploit preconditions, or distribution mappings. Analysis should stay anchored to the stable Linux commits and verify exact affected ranges through vendor advisories before declaring exposure.

Mitigation direction

  • Apply vendor Linux kernel updates that include the referenced stable fixes.
  • Check distribution security advisories for package-specific fixed versions.
  • Prioritize KVM guest systems using hibernate or restore workflows.
  • Avoid relying on unsupported kernels where vendor fixes are unavailable.
  • Track vendor guidance for any operational workaround beyond patching.

Validation and detection

  • Inventory Linux kernel versions across KVM guest workloads.
  • Confirm whether affected systems use kvmclock under virtualization.
  • Map installed kernels to vendor advisories or referenced stable commits.
  • Review whether hibernate or restore workflows are enabled.
  • Retest after patching to confirm updated kernel deployment.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47110 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1e977aa12dd4f80688b1f243762212e75c6d7fe8, 1e977aa12dd4f80688b1f243762212e75c6d7fe8, 1e977aa12dd4f80688b1f243762212e75c6d7fe8, 1e977aa12dd4f80688b1f243762212e75c6d7fe8unaffected
LinuxLinux2.6.26, 0, 5.4.125, 5.10.43, 5.12.10, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.