Security readout for executives and security teams
Plain-English summary
This Linux kernel issue comes from uninitialized memory in a networking extension used around traffic-control metadata. The public record shows a detected invalid value during Open vSwitch packet processing, but does not provide a CVSS score, confirmed security impact, or active exploitation evidence.
Executive priority
Treat as a patch-management item for Linux networking infrastructure, not as an emergency based on current evidence. Escalate priority where Open vSwitch, virtual networking, or sensitive production network paths depend on affected kernels.
Technical view
skb_ext_add() allocated TC_SKB_EXT without zeroing it. After TC_SKB_EXT gained additional fields, some callers still initialized only the chain value, leaving newer fields uninitialized. The cited UBSAN trace shows an invalid _Bool load in net/openvswitch/flow.c during packet receive processing.
Likely exposure
Exposure is limited to Linux systems running affected kernel code paths. The bundle names Linux kernel versions including 5.9, 5.10.42, 5.12.9, and 5.13, plus kernel commit identifiers, but downstream distribution status must be validated from vendor kernel advisories.
Exploitation context
The source bundle does not show KEV listing, exploit publication, or confirmed active exploitation. Evidence is a kernel UBSAN invalid-load report during Open vSwitch processing. Practical exploitability and business impact are not established by the supplied sources.
Researcher notes
The strongest evidence is the upstream fix rationale and UBSAN trace. The record lacks CVSS, CWE, exploitability analysis, and downstream distro mapping. Avoid asserting confidentiality, integrity, availability impact, or exploitability without additional vendor or maintainer evidence.
Mitigation direction
- Apply Linux kernel vendor updates that include the referenced stable commits.
- Prioritize systems using Open vSwitch or advanced traffic-control networking features.
- If no update is available, request vendor backport or mitigation guidance.
- Track distribution advisories rather than relying only on upstream version numbers.
Validation and detection
- Inventory running kernel versions and vendor build identifiers.
- Compare installed kernels with vendor advisories and referenced stable commits.
- Review kernel logs for UBSAN invalid-load reports involving Open vSwitch or TC_SKB_EXT.
- Confirm patched kernels boot and networking workloads remain stable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47136 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ac493452e937b8939eaf2d24cac51a4804b6c20eCVE reference, Linux
- https://git.kernel.org/stable/c/86ab133b695ed7ba1f8786b12f4ca43137ad8c18CVE reference, Linux
- https://git.kernel.org/stable/c/9453d45ecb6c2199d72e73c993e9d98677a2801bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.