Security readout for executives and security teams
Plain-English summary
CVE-2021-47237 is a Linux kernel memory leak in the hamradio MKISS networking path. When MKISS was opened and then closed, allocated network device memory was unregistered but not freed. Over repeated triggering, this could waste kernel memory and affect system stability. Public sources do not report active exploitation.
Executive priority
Treat as routine-to-priority patching rather than emergency response. Focus first on older Linux kernels, custom builds, embedded systems, and environments where specialist networking or tty line disciplines are exposed to untrusted local users.
Technical view
The issue is in mkiss_close(): mkiss_open() allocates and registers a netdevice, but close only unregisters it. The resolved fix adds the missing free_netdev() cleanup. The source bundle lists affected Linux kernel ranges from 2.6.14 through 5.13-era stable branches and references multiple upstream stable commits.
Likely exposure
Exposure is most likely on Linux systems running affected kernels where the hamradio MKISS/AX.25 tty line discipline path is present and reachable. General servers may have low practical exposure if this subsystem is absent or inaccessible, but custom kernels and older embedded or specialist Linux deployments should be checked.
Exploitation context
The evidence is a syzbot-discovered memory leak with kernel backtraces. The bundle marks KEV as false and provides no cited evidence of in-the-wild exploitation, public weaponization, privilege escalation, or remote attack capability.
Researcher notes
The record lacks CVSS, CWE, and exploitability detail. Analysis should stay scoped to a memory leak in Linux MKISS close handling. Do not assume remote reachability or active exploitation without additional evidence from vendor advisories or threat intelligence.
Mitigation direction
- Update affected Linux kernels to builds containing the referenced stable fixes.
- Use vendor-packaged kernel updates where available.
- For custom kernels, include the mkiss_close free_netdev cleanup fix.
- Check Linux distribution guidance for any supported interim workaround.
Validation and detection
- Inventory Linux kernel versions across affected systems.
- Confirm whether hamradio MKISS/AX.25 support is built or loaded.
- Verify patched kernels include one of the referenced stable commits.
- Monitor kernel memory stability after patching high-risk systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47237 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c634ba0b4159838ff45a60d3a0ace3b4118077a5CVE reference, Linux
- https://git.kernel.org/stable/c/3942d0f9ace1a95a74930b5b4fc0e5005c62b37bCVE reference, Linux
- https://git.kernel.org/stable/c/765a8a04f828db7222b36a42b1031f576bfe95c3CVE reference, Linux
- https://git.kernel.org/stable/c/c16c4716a1b5ba4f83c7e00da457cba06761f119CVE reference, Linux
- https://git.kernel.org/stable/c/a49cbb762ef20655f5c91abdc13658b0af5e159dCVE reference, Linux
- https://git.kernel.org/stable/c/290b0b6432e2599021db0b8d6046f756d931c29fCVE reference, Linux
- https://git.kernel.org/stable/c/f4de2b43d13b7cf3ced9310e371b90c836dbd7cdCVE reference, Linux
- https://git.kernel.org/stable/c/7edcc682301492380fbdd604b4516af5ae667a13CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.