Security readout for executives and security teams
Plain-English summary
CVE-2021-47175 is a Linux kernel networking scheduler bug in fq_pie. Under specific traffic-control configuration, the kernel can read past allocated memory in the packet path. The provided sources show a kernel fix, but do not establish active exploitation or business impact beyond kernel stability and possible security risk.
Executive priority
Schedule remediation through normal kernel patch management, with higher priority for network appliances, hosts using traffic shaping, and environments allowing privileged traffic-control changes. Current evidence does not justify emergency response absent local exposure or vendor escalation.
Technical view
The flaw is an out-of-bounds access in net/sched fq_pie. fq_pie_qdisc_enqueue can select q->flows + q->flows_cnt as if it were valid, addressing memory past the allocated flow array. The report includes a KASAN slab-out-of-bounds read on Linux 5.12.0+ and stable kernel fix references.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with fq_pie traffic scheduling available or configured. The bundle lists Linux 5.6, 5.10.42, 5.12.9, and 5.13 as affected data points, but does not provide a complete distribution-specific matrix.
Exploitation context
The source bundle includes a reproducible kernel fault scenario, but no public exploit claim and no CISA KEV listing. Treat active exploitation as unconfirmed. Practical exposure appears tied to systems where traffic-control configuration can influence fq_pie behavior.
Researcher notes
The key root cause is flow index validation in fq_pie’s enqueue path. The public record provides fix commits and a KASAN trace, but no CVSS, CWE, exploit-in-the-wild evidence, or distribution-specific remediation table. Avoid expanding impact beyond the stated out-of-bounds access.
Mitigation direction
- Apply vendor kernel updates that include the upstream fq_pie fixes.
- Check distribution advisories for affected kernel package ranges.
- Prioritize hosts using Linux traffic control or custom qdisc configuration.
- Avoid relying on unverified workarounds not named by the vendor.
- Track the referenced stable kernel commits during remediation review.
Validation and detection
- Inventory Linux kernel versions across internet-facing and network infrastructure hosts.
- Check whether fq_pie is configured on relevant interfaces.
- Confirm patched builds include the referenced stable fix commits.
- Review change logs from the operating system vendor.
- Run normal regression tests after kernel updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47175 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e6294c06e7c62ffdd5bf3df696d3a4fcbb753d3cCVE reference, Linux
- https://git.kernel.org/stable/c/7a1bdec12e43e29cc34a4394590337069d8812ceCVE reference, Linux
- https://git.kernel.org/stable/c/e70f7a11876a1a788ceadf75e9e5f7af2c868680CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.