CVE-2021-47260: Linux vulnerability

CVE-2021-47260: NFS: Fix a potential NULL dereference in nfs_get_client()

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential NULL dereference in nfs_get_client() None of the callers are expecting NULL returns from nfs_get_client() so this code will lead to an Oops. It's better to return an error pointer. I expect that this is dead code so hopefully no one is affected.

UnknownCVSS not scoredNot KEV-listedUpdatedMay 11, 2026, 13:51 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

CVE-2021-47260 is a Linux kernel NFS bug that could crash affected systems if a rare NULL return path is reached. The source notes the path may be dead code, so practical impact is unclear.

Executive priority

Treat this as routine kernel hygiene unless NFS-heavy or high-availability systems run affected kernels. There is no sourced evidence of active exploitation, but a kernel Oops can still affect availability.

Technical view

In Linux NFS, nfs_get_client() could return NULL even though callers did not expect NULL, leading to a kernel Oops. Stable fixes changed this to return an error pointer. The bundle provides no CVSS score or confirmed triggerability.

Likely exposure

Exposure is limited to affected Linux kernel versions with relevant NFS client code. The source bundle does not identify specific distributions, configurations, or whether remote unauthenticated triggering is possible.

Exploitation context

The CVE is not listed as KEV in the bundle, and no cited source confirms active exploitation. The kernel note says the affected code may be dead code, making exploitability uncertain.

Researcher notes

The record describes a potential NULL dereference in nfs_get_client() and explicitly questions whether reachable code is live. Further triage should focus on branch-specific kernel diffs and distribution backport status, not assumed exploitability.

Mitigation direction

Check vendor kernel advisories for CVE-2021-47260 applicability.
Update affected Linux kernels to a version containing the referenced stable fixes.
Prioritize NFS-enabled systems and uptime-sensitive workloads first.
If no vendor package is available, follow vendor-supported backport guidance.

Validation and detection

Inventory Linux kernel versions across servers and appliances.
Identify systems with NFS client functionality enabled or in use.
Confirm vendor kernel changelogs include the CVE or referenced stable commits.
Document systems deferred due to vendor support constraints.

Prepared: Jun 1, 2026, 15:57 UTC (UTC+00:00)
Confidence: medium
Sources: 5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47260 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: May 21, 2024, 14:19 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

2ADP providers

9Source links

SSVC decision data

Timestamp: May 23, 2024, 18:03 UTC (UTC+00:00)
Version: 2.0.3

Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
May 21, 2024, 13:27 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
May 21, 2024, 14:19 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
May 11, 2026, 13:51 UTC (UTC+00:00)

ADP provider summaries

other:ssvc

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/fab8bfdfb4aac9e4e8363666333adfdf21e89106CVE reference, Linux
https://git.kernel.org/stable/c/a979e601000982a3ca693171a6d4dffc47f8ad00CVE reference, Linux
https://git.kernel.org/stable/c/634f17ff1d59905eb3b4bbbc00805961d08beaeeCVE reference, Linux
https://git.kernel.org/stable/c/4b380a7d84ef2ce3f4f5bec5d8706ed937ac6502CVE reference, Linux
https://git.kernel.org/stable/c/0057ecef9f324007c0ba5fcca4ddd131178ce78bCVE reference, Linux
https://git.kernel.org/stable/c/279ad78a00f8b9c5ff24171a59297187a3bd44b7CVE reference, Linux
https://git.kernel.org/stable/c/58ddf61f10b8f9b7b1341644bfee2f1c6508d4e1CVE reference, Linux
https://git.kernel.org/stable/c/09226e8303beeec10f2ff844d2e46d1371dc58e0CVE reference, Linux

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinux31434f496abb9f3410b10f541462fe58613dd3ad, 31434f496abb9f3410b10f541462fe58613dd3ad, 31434f496abb9f3410b10f541462fe58613dd3ad, 31434f496abb9f3410b10f541462fe58613dd3ad, 31434f496abb9f3410b10f541462fe58613dd3ad, 31434f496abb9f3410b10f541462fe58613dd3ad, 31434f496abb9f3410b10f541462fe58613dd3ad, 31434f496abb9f3410b10f541462fe58613dd3adunaffected

LinuxLinux3.17, 0, 4.4.273, 4.9.273, 4.14.237, 4.19.195, 5.4.126, 5.10.44, 5.12.11, 5.13affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.