Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash affected systems when the rp2 serial driver handles an interrupt before its ports are fully initialized after missing firmware. The likely business impact is availability loss, not confirmed data theft. Exposure depends on whether affected kernels and the rp2 serial driver are present.
Executive priority
Treat as a targeted kernel availability risk. Prioritize normal kernel patching, with higher urgency for systems using specialized serial hardware or custom kernels. There is no source-backed evidence of active exploitation.
Technical view
The rp2 serial driver registered its interrupt handler, then asynchronously requested firmware. If firmware was absent, initialization returned early, leaving rp2_card ports uninitialized. A later interrupt could dereference NULL or trigger related kernel faults. The fix changes firmware loading to the synchronous request_firmware path so initialization completes before interrupts are handled.
Likely exposure
Linux systems running affected kernel versions with the rp2 serial driver available or in use are the relevant population. The source lists Linux kernel versions and stable commits, but does not map exposure to distributions or default configurations.
Exploitation context
The bundle does not show active exploitation, public weaponization, or KEV listing. The reported failure is a kernel NULL pointer dereference observed through an interrupt path, indicating denial-of-service potential under specific driver and firmware conditions.
Researcher notes
Focus validation on the driver initialization order: interrupt registration before asynchronous firmware callback could leave port structures unset when firmware is missing. Exact affected ranges need distro backport analysis because the source provides upstream stable commits, not package-level status.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Check distribution advisories for backported fixes matching your kernel package.
- Prioritize systems where the rp2 serial driver is loaded or required.
- If patching is delayed, ask the vendor about safely disabling unused rp2 support.
Validation and detection
- Inventory kernel versions and compare them with vendor-fixed releases.
- Check whether the rp2 serial driver is built, loadable, or loaded.
- Review kernel logs for rp2 firmware failures or NULL dereference crashes.
- Confirm the applied kernel includes the stable rp2 firmware-loading fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47169 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1e04d5d5fe5e76af68f834e1941fcbfa439653beCVE reference, Linux
- https://git.kernel.org/stable/c/c697244ce940ec07e2d745ccb63ca97fc0266fbcCVE reference, Linux
- https://git.kernel.org/stable/c/1cc57cb32c84e059bd158494f746b665fc14d1b1CVE reference, Linux
- https://git.kernel.org/stable/c/35265552c7fe9553c75e324c80f45e28ff14eb6eCVE reference, Linux
- https://git.kernel.org/stable/c/915452f40e2f495e187276c4407a4f567ec2307eCVE reference, Linux
- https://git.kernel.org/stable/c/6a931ceb0b9401fe18d0c500e08164bf9cc7be4bCVE reference, Linux
- https://git.kernel.org/stable/c/9b07b6973f7359e2dd6a9fe6db0c142634c823b7CVE reference, Linux
- https://git.kernel.org/stable/c/016002848c82eeb5d460489ce392d91fe18c475cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.