Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can leave resources behind when an mlx5e hairpin networking setup is torn down in the wrong order. The observed failure is a kernel warning, page reclaim timeout, and leaked command resource during PCI device removal. Business impact appears availability and operational stability, not confirmed data theft or remote code execution.
Executive priority
Treat as a targeted infrastructure reliability issue. Prioritize patching on hosts using mlx5-based NIC offload or virtual switching features, especially where device unbind, hotplug, or maintenance operations occur. It is not evidenced as broadly exploitable from the supplied sources.
Technical view
In net/mlx5e, adding a hairpin flow creates a firmware-side send queue for a peer net device. If the peer device is removed or unbound before the hairpin flow is deleted, the send queue is not destroyed, causing firmware page reclaim failures during mlx5 PCI teardown. The issue is listed as resolved in Linux stable commits.
Likely exposure
Exposure is most likely on Linux systems using the mlx5e/mlx5_core driver with hairpin flows, such as advanced NIC offload configurations. General Linux hosts without this driver or feature path are unlikely to be exposed based on the provided sources.
Exploitation context
The sources do not report active exploitation, and KEV is false. The described trigger requires a specific ordering of hairpin flow and peer net device teardown. Evidence supports a reliability/resource-leak issue during device removal, not a proven remote attack path.
Researcher notes
The public record lacks CVSS, CWE, and detailed exploitability analysis. The useful signal is the kernel commit narrative: an mlx5e hairpin send queue survives peer net device removal, leaving firmware pages unreclaimed during PCI teardown. Validate by feature use and patch presence, not CVE matching alone.
Mitigation direction
- Update to a Linux kernel containing the referenced stable fixes.
- Check Linux distribution advisories for backported mlx5e fixes.
- Avoid risky peer net device unbind/removal before hairpin flow cleanup where operationally possible.
- Schedule maintenance for exposed hosts using mlx5e hairpin offload configurations.
Validation and detection
- Inventory hosts loading mlx5_core or mlx5e drivers.
- Identify kernels matching affected versions or missing referenced fixes.
- Review configurations using hairpin flows, tc flower, OVS, or related offloads.
- Check kernel logs for MANAGE_PAGES timeout or mlx5 page reclaim warnings.
- Confirm vendor kernel packages include the stable fix commits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47246 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4b16118665e94c90a3e84a5190486fd0e4eedd74CVE reference, Linux
- https://git.kernel.org/stable/c/be7f3f401d224e1efe8112b2fa8b837eeb8c5e52CVE reference, Linux
- https://git.kernel.org/stable/c/b374c1304f6d3d4752ad1412427b7bf02bb1fd61CVE reference, Linux
- https://git.kernel.org/stable/c/a3e5fd9314dfc4314a9567cde96e1aef83a7458aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.