LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47112: x86/kvm: Teardown PV features on boot CPU as well

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Teardown PV features on boot CPU as well Various PV features (Async PF, PV EOI, steal time) work through memory shared with hypervisor and when we restore from hibernation we must properly teardown all these features to make sure hypervisor doesn't write to stale locations after we jump to the previously hibernated kernel (which can try to place anything there). For secondary CPUs the job is already done by kvm_cpu_down_prepare(), register syscore ops to do the same for boot CPU.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects KVM paravirtualization cleanup during hibernation restore. Some shared memory links with the hypervisor were not torn down for the boot CPU, creating a risk that the hypervisor writes to stale memory after resume. Business urgency depends on whether affected Linux kernels use KVM virtualization and hibernation.

Executive priority

Handle through normal kernel patch governance unless your environment uses KVM with hibernation workflows. There is no cited active exploitation or severity score, but kernel memory-state bugs can have high impact if exposure conditions exist.

Technical view

The fix registers syscore operations so x86 KVM paravirtual features, including async page fault, PV EOI, and steal time, are torn down for the boot CPU during hibernation restore. Secondary CPUs already used kvm_cpu_down_prepare(). The source record lists affected Linux kernel ranges and stable commit references, but provides no CVSS or CWE.

Likely exposure

Exposure appears limited to affected Linux kernels in KVM environments where hibernation restore is relevant. The provided data does not identify specific distributions, cloud images, or default configurations, so asset owners must map deployed kernel packages to vendor-fixed builds.

Exploitation context

The supplied sources do not report active exploitation, and the CVE is not listed as KEV. The issue is a kernel state-management flaw around stale hypervisor-shared memory after hibernation restore, not a documented remote exploit path in the provided evidence.

Researcher notes

Focus validation on x86 KVM PV feature teardown across hibernation restore. The key behavior is ensuring boot CPU cleanup matches secondary CPU cleanup for async PF, PV EOI, and steal time shared memory. Evidence is commit-level; product and exploit details are incomplete.

Mitigation direction

  • Update affected Linux kernels to versions containing the referenced stable fixes.
  • Use distribution advisories to map installed kernel packages to fixed builds.
  • Prioritize KVM virtualized systems where hibernation or resume workflows are enabled.
  • If patch status is unclear, request vendor guidance for CVE-2021-47112.

Validation and detection

  • Inventory Linux kernel versions across KVM guests and virtualization hosts.
  • Check whether deployed kernel builds include the listed stable commits.
  • Confirm whether hibernation or resume-from-hibernation is enabled in affected environments.
  • Track vendor security advisories for package-specific fixed versions.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47112 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfd10cde9294f73eeccbc16f3fec1ae6cde7b800c, fd10cde9294f73eeccbc16f3fec1ae6cde7b800c, fd10cde9294f73eeccbc16f3fec1ae6cde7b800c, fd10cde9294f73eeccbc16f3fec1ae6cde7b800cunaffected
LinuxLinux2.6.38, 0, 5.4.125, 5.10.43, 5.12.10, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.