Security readout for executives and security teams
Plain-English summary
This is a Linux kernel netfilter issue in the nftables packet-filtering path. On affected systems, an optimized AVX2 lookup can run when kernel floating-point use is not safe, triggering kernel warnings in interrupt context. The sources do not provide CVSS, confirmed impact beyond the warning, or active exploitation evidence.
Executive priority
Handle through normal kernel patch governance, with higher priority for internet-facing or high-throughput network filtering systems. There is no source-supported evidence of active exploitation, but the vulnerable code sits in a privileged packet-processing path where instability can affect availability.
Technical view
CVE-2021-47174 concerns nft_set_pipapo_avx2 in nf_tables. The fix adds an irq_fpu_usable() check and falls back to the non-AVX2 implementation when FPU state cannot be used safely. The reported trace involves nft_pipapo_avx2_lookup during packet processing on Linux 5.10.24.
Likely exposure
Exposure is most likely on Linux systems using nftables/netfilter with pipapo sets on AVX2-capable x86 hardware, especially network-forwarding, NAT, firewall, or router workloads. The CVE metadata lists Linux kernel versions around 5.7 and stable fixes including 5.10.42, 5.12.9, and 5.13, but exact range detail is incomplete in the bundle.
Exploitation context
The provided sources show a kernel warning/backtrace, not an exploit. CISA KEV status is false, and no cited source claims active exploitation. Treat this as a kernel reliability and packet-filtering-path defect unless vendor advisories describe a stronger security impact for your distribution.
Researcher notes
The core condition is unsafe use of the AVX2 pipapo lookup when irq_fpu_usable() is false. The public bundle lacks CVSS, CWE, exploitability analysis, and complete version-range structure, so validation should rely on kernel commit presence and distribution-specific advisories.
Mitigation direction
- Update affected Linux kernels to vendor-supported builds containing the referenced stable fixes.
- Prioritize firewalls, NAT gateways, routers, and hosts using nftables rulesets.
- Check your Linux distribution advisory for exact package names and fixed versions.
- If immediate patching is blocked, review vendor guidance for temporary nftables or kernel workarounds.
Validation and detection
- Inventory Linux kernel versions on systems that perform nftables filtering or forwarding.
- Confirm whether nf_tables and nft pipapo sets are used in production rulesets.
- Review kernel logs for warnings referencing kernel_fpu_begin_mask or nft_pipapo_avx2_lookup.
- Verify deployed kernels include fixes corresponding to the referenced stable commits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47174 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b1f45a26bd322525c14edd9504f6d46dfad679a4CVE reference, Linux
- https://git.kernel.org/stable/c/727a2b4fc951ee69847d4904d98961856ea9fbe6CVE reference, Linux
- https://git.kernel.org/stable/c/f0b3d338064e1fe7531f0d2977e35f3b334abfb4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.