LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47179: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() Commit de144ff4234f changes _pnfs_return_layout() to call pnfs_mark_matching_lsegs_return() passing NULL as the struct pnfs_layout_range argument. Unfortunately, pnfs_mark_matching_lsegs_return() doesn't check if we have a value here before dereferencing it, causing an oops. I'm able to hit this crash consistently when running connectathon basic tests on NFS v4.1/v4.2 against Ontap.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-47179 is a Linux kernel NFSv4 flaw that can trigger a kernel oops from a NULL pointer dereference. The report describes consistent crashes during NFS v4.1/v4.2 connectathon basic tests against Ontap. The practical concern is service availability for Linux systems using affected NFSv4 client code.

Executive priority

Schedule remediation through normal kernel patch cycles, with higher priority for business-critical NFS clients. Escalate if internal evidence shows crashes, NFS instability, or exposure on critical file-service paths.

Technical view

The bug is in pnfs_mark_matching_lsegs_return(). A prior change made _pnfs_return_layout() pass a NULL pnfs_layout_range pointer, but the callee dereferenced it without checking. Linux stable commits add the missing handling. Sources do not provide CVSS, CWE, exploitability, or broad attack prerequisites.

Likely exposure

Likely exposure is Linux systems using NFSv4, especially v4.1/v4.2 pNFS layouts, on kernel builds containing the faulty change before the stable fixes. The provided data names Linux only and does not identify distributions or non-Linux products.

Exploitation context

No CISA KEV listing is provided, and the bundle does not cite active exploitation. Evidence is limited to reproducible crashes in testing against Ontap, so treat this as an availability risk until vendor or distribution guidance says otherwise.

Researcher notes

The source bundle supports a NULL dereference in Linux NFSv4 pNFS layout-return handling. It does not establish remote exploitability, privilege requirements, exploit availability, or data compromise. Analysis should stay focused on crash reproduction conditions and fixed kernel lineage.

Mitigation direction

  • Apply Linux kernel stable updates containing the referenced fixes.
  • Check your distribution security advisory for the corrected package version.
  • Prioritize NFSv4 client systems and systems using pNFS layouts.
  • If immediate patching is delayed, consult vendor guidance for safe NFSv4 workarounds.

Validation and detection

  • Inventory Linux hosts that mount or rely on NFSv4.1 or NFSv4.2.
  • Compare running kernel builds against vendor fixed versions or referenced stable commits.
  • Review logs for kernel oops or NFSv4/pNFS layout-return crashes.
  • Confirm patched systems no longer run affected kernel builds.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47179 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux80e34f4957ec3010c85f9bb0b568a8d46acdf535, 7b7b9774643220e53eef58c15bb29bd4182fe053, 9ffa7967f9379a0a1b924e9ffeda709d72237da7, 6be0e4b59314e4a836495f6ffdc5d2c5b079deeb, 2fafe7d5047f98791afd9a1d90d2afb70debc590, 7e65ea887d0c0997f3053acd91a027af45e71c5b, de144ff4234f935bd2150108019b5d87a90a8a96, 96260bde1ea8ae31a5402fe506abbb8951d5a42cunaffected
LinuxLinux4.9.269, 4.14.233, 4.19.191, 5.4.118, 5.10.36, 5.12.3unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.