LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47166: NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()

In the Linux kernel, the following vulnerability has been resolved: NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() The value of mirror->pg_bytes_written should only be updated after a successful attempt to flush out the requests on the list.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-47166 is a Linux kernel NFS issue where write accounting could be updated before a write flush succeeded. For organizations, the practical concern is reliability and data integrity for systems using Linux NFS. The source bundle provides fixes but no CVSS score, CWE, or confirmed exploitation evidence.

Executive priority

Handle through normal kernel patch management, with priority raised for systems that rely on NFS for production data. There is not enough source evidence to justify emergency response solely for this CVE.

Technical view

The kernel NFS code in nfs_do_recoalesce() could corrupt mirror->pg_bytes_written by updating it before successful flushing of requests. The provided Linux stable commits correct the update ordering. Impact details, attack prerequisites, and exploitability are not described in the provided sources.

Likely exposure

Exposure is most relevant to Linux systems using NFS functionality on affected kernel versions listed in the CVE bundle, including multiple 4.x and 5.x lines. Systems not using NFS may have lower practical exposure, but the sources do not define precise runtime conditions.

Exploitation context

The bundle marks KEV as false and provides no source claiming active exploitation or public exploit use. The available evidence supports treating this as a kernel correctness and possible data-integrity issue, not as a confirmed exploited vulnerability.

Researcher notes

The source bundle names the faulty accounting variable and function but does not provide CVSS, CWE, detailed impact, trigger conditions, or exploitability. Analysis should stay close to kernel commit context and distro backports.

Mitigation direction

  • Identify Linux hosts using NFS client or server functionality.
  • Upgrade to a vendor-supported kernel containing the referenced stable fixes.
  • Prioritize systems with business-critical NFS writes or shared storage workflows.
  • Check Linux distribution advisories for packaged fixed kernel versions.
  • Avoid unsupported kernel branches where stable fixes are not available.

Validation and detection

  • Inventory kernel versions across Linux NFS-dependent systems.
  • Confirm whether NFS modules or mounts are in use.
  • Map deployed kernels against vendor advisories and listed fixed commits.
  • Review storage logs for NFS writeback or data consistency anomalies.
  • Verify patched kernels after maintenance windows.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47166 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa7d42ddb3099727f58366fa006f850a219cce6c8, a7d42ddb3099727f58366fa006f850a219cce6c8, a7d42ddb3099727f58366fa006f850a219cce6c8, a7d42ddb3099727f58366fa006f850a219cce6c8, a7d42ddb3099727f58366fa006f850a219cce6c8, a7d42ddb3099727f58366fa006f850a219cce6c8, a7d42ddb3099727f58366fa006f850a219cce6c8, a7d42ddb3099727f58366fa006f850a219cce6c8unaffected
LinuxLinux4.0, 0, 4.4.271, 4.9.271, 4.14.235, 4.19.193, 5.4.124, 5.10.42, 5.12.9, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.