LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47125: sch_htb: fix refcount leak in htb_parent_to_leaf_offload

In the Linux kernel, the following vulnerability has been resolved: sch_htb: fix refcount leak in htb_parent_to_leaf_offload The commit ae81feb7338c ("sch_htb: fix null pointer dereference on a null new_q") fixes a NULL pointer dereference bug, but it is not correct. Because htb_graft_helper properly handles the case when new_q is NULL, and after the previous patch by skipping this call which creates an inconsistency : dev_queue->qdisc will still point to the old qdisc, but cl->parent->leaf.q will point to the new one (which will be noop_qdisc, because new_q was NULL). The code is based on an assumption that these two pointers are the same, so it can lead to refcount leaks. The correct fix is to add a NULL pointer check to protect qdisc_refcount_inc inside htb_parent_to_leaf_offload.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-47125 is a Linux kernel HTB traffic scheduler bug. A prior null-pointer fix left internal queue pointers inconsistent, causing a reference-count leak. The sources do not provide CVSS, CWE, or active exploitation evidence, so business impact is uncertain and should be handled through kernel maintenance processes.

Executive priority

Track as a routine-to-priority kernel maintenance item, not an emergency based on current evidence. Raise priority for internet-facing, multi-tenant, or traffic-shaping systems once vendor advisories confirm affected builds and fixed packages.

Technical view

The resolved issue is in sch_htb, specifically htb_parent_to_leaf_offload. Skipping htb_graft_helper when new_q is NULL could leave dev_queue->qdisc and cl->parent->leaf.q inconsistent. Kernel code assumed those pointers matched, allowing refcount leaks. The fix adds a NULL check around qdisc_refcount_inc.

Likely exposure

Exposure appears limited to Linux systems running affected kernel builds listed by the CVE source, including Linux 5.12, 5.12.10, and 5.13 references. Exact distribution impact is not established in the provided sources; validate against the running kernel and vendor advisories.

Exploitation context

The bundle says CISA KEV is false and provides no cited evidence of active exploitation, public exploit availability, or remote attack conditions. Treat this as a kernel correctness and stability issue until vendor guidance provides more risk detail.

Researcher notes

Evidence is narrow: the CVE description identifies a refcount leak caused by pointer inconsistency after a previous null-pointer fix. No CVSS, CWE, exploitability analysis, or distribution-specific fixed versions are included in the supplied bundle.

Mitigation direction

  • Inventory Linux kernel versions across production and edge systems.
  • Check distribution advisories for CVE-2021-47125 applicability.
  • Apply vendor-supported kernel updates containing the stable fixes.
  • Prioritize hosts using HTB traffic shaping or network queuing features.
  • Reboot or live-patch according to vendor kernel update guidance.

Validation and detection

  • Confirm running kernel versions on Linux assets.
  • Compare installed kernel packages with vendor fixed versions.
  • Review whether HTB queuing is configured on relevant interfaces.
  • Verify patched kernels include the referenced stable commits.
  • Monitor kernel logs for network scheduler or qdisc anomalies.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47125 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxae81feb7338c89cee4e6aa0424bdab2ce2b52da2, ae81feb7338c89cee4e6aa0424bdab2ce2b52da2unaffected
LinuxLinux5.12, 0, 5.12.10, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.