Security readout for executives and security teams
Plain-English summary
This Linux kernel KVM issue can let stale tracepoint data survive after KVM vendor modules unload. On affected virtualization hosts, a local low-privileged user could cause sensitive memory disclosure or host instability. It is important for hypervisors, but the supplied sources do not show active exploitation.
Executive priority
Patch in the normal high-priority kernel maintenance cycle, faster for shared virtualization hosts or systems with untrusted local users. No source indicates emergency internet-scale exploitation, but confidentiality and availability impact are high.
Technical view
The bug is in KVM x86 nested VM-Enter failure tracing. The tracepoint kept pointers to string literals from kvm-intel or kvm-amd modules; after module unload, ring-buffer trace data could dereference freed memory. The fix copies strings using tracing __string() machinery.
Likely exposure
Exposure is most likely on Linux systems running affected 5.4, 5.10, 5.12, or 5.13 kernel lines with KVM x86 enabled, especially hosts using kvm-intel or kvm-amd as modules and nested virtualization tracing paths.
Exploitation context
The CVSS vector is local, low complexity, low privilege, no user interaction. The source bundle marks KEV false and provides no evidence of public exploitation. Treat it as a host-local virtualization risk, not a remotely exploitable internet service issue.
Researcher notes
The root issue is tracepoint lifetime mismatch: KVM-owned tracepoint data may outlive module-owned string storage. Focus validation on affected kernel lineage, KVM module build mode, and whether vendor patches map to the four referenced stable commits.
Mitigation direction
- Apply Linux kernel updates containing the referenced stable KVM fixes.
- Prioritize virtualization hosts, CI runners, and systems offering local shell access.
- Check distribution advisories for backported fixes matching your kernel build.
- Avoid unnecessary KVM vendor module unloads before patching, where operationally feasible.
Validation and detection
- Inventory Linux kernel versions on KVM-capable x86 hosts.
- Confirm whether kvm-intel or kvm-amd are loaded as modules.
- Verify installed kernel packages include the referenced stable commits or vendor backports.
- Review kernel logs for trace_check_vprintf or kvm_nested_vmenter_failed warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47262 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/796d3bd4ac9316e70c181189318cd2bd98af34bcCVE reference, Linux
- https://git.kernel.org/stable/c/d046f724bbd725a24007b7e52b2d675249870888CVE reference, Linux
- https://git.kernel.org/stable/c/9fb088ce13bc3c59a51260207b487db3e556f275CVE reference, Linux
- https://git.kernel.org/stable/c/f31500b0d437a2464ca5972d8f5439e156b74960CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.