LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47239: net: usb: fix possible use-after-free in smsc75xx_bind

In the Linux kernel, the following vulnerability has been resolved: net: usb: fix possible use-after-free in smsc75xx_bind The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind") fails to clean up the work scheduled in smsc75xx_reset-> smsc75xx_set_multicast, which leads to use-after-free if the work is scheduled to start after the deallocation. In addition, this patch also removes a dangling pointer - dev->data[0]. This patch calls cancel_work_sync to cancel the scheduled work and set the dangling pointer to NULL.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-47239 is a Linux kernel driver memory-safety flaw in the smsc75xx USB Ethernet path. Under certain cleanup timing, scheduled work could run after related memory was freed. Business urgency depends on whether affected Linux kernels use this driver. The sources do not provide CVSS, impact scoring, or active exploitation evidence.

Executive priority

Handle through kernel patch management, with elevated priority for appliances, kiosks, or operational systems that rely on SMSC75xx USB Ethernet. The evidence does not support emergency treatment absent confirmed exposure or vendor escalation.

Technical view

The issue is a use-after-free in smsc75xx_bind caused by cleanup missing work scheduled through smsc75xx_reset and smsc75xx_set_multicast. The kernel fix cancels pending work with cancel_work_sync and clears dev->data[0] to remove a dangling pointer. Stable kernel fix commits are cited across multiple branches.

Likely exposure

Exposure is most likely where Linux kernels include the vulnerable smsc75xx driver code and systems use SMSC75xx USB Ethernet functionality. The supplied data lists Linux kernel commit and stable-version references, but does not identify distributions, products, or deployment prevalence.

Exploitation context

The CVE is not listed as KEV in the supplied bundle. No cited source states active exploitation, public exploit availability, attacker prerequisites, or reachable impact. Treat exploitation details as incomplete rather than assuming internet-scale risk.

Researcher notes

The useful research focus is exposure mapping, not exploit development. Confirm branch-specific fix inclusion, distribution backports, and whether smsc75xx_bind failure paths can be reached in deployed hardware profiles. Source evidence lacks CVSS, CWE, exploitation, and detailed impact statements.

Mitigation direction

  • Update affected Linux kernels to versions containing the cited stable fixes.
  • Prioritize systems using SMSC75xx USB Ethernet adapters or embedded USB networking.
  • If patching is delayed, review vendor guidance for disabling unused smsc75xx support.
  • Track distribution advisories for backported kernel fixes.
  • Regression-test USB Ethernet connectivity after kernel updates.

Validation and detection

  • Inventory kernel versions and compare against vendor fixed builds or cited stable commits.
  • Check whether the smsc75xx driver is built, loaded, or required.
  • Review hardware inventory for SMSC75xx USB Ethernet usage.
  • Confirm patched kernels include the cancel_work_sync and dev->data[0] cleanup changes.
  • Run normal network and reboot regression tests on affected device classes.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47239 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux200dbfcad8011e50c3cec269ed7b980836eeb1fa, 22c840596af0c09068b6cf948616e6496e59e07f, 9e6b8c1ff9d997e1fa16cbd2d60739adf6dc1bbc, 9e6a3eccb28779710cbbafc4f4258d92509c6d07, b95fb96e6339e34694dd578fb6bde3575b01af17, 635ac38b36255d3cfb8312cf7c471334f4d537e0, 70c886ac93f87ae7214a0c69151a28a8075dd95b, 46a8b29c6306d8bbfd92b614ef65a47c900d8e70unaffected
LinuxLinux4.4.271, 4.9.271, 4.14.235, 4.19.193, 5.4.124, 5.10.42, 5.12.9unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.