Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw affects IP over InfiniBand systems using network namespaces. Under a specific namespace teardown condition, an IPoIB network device can disappear instead of returning to the initial namespace, triggering a kernel warning and potentially a shutdown-time kernel panic.
Executive priority
Prioritize for HPC, storage, virtualization, or container hosts using InfiniBand/IPoIB. Treat as lower urgency for ordinary Linux servers without RDMA/IPoIB. Patch through normal kernel maintenance unless operational evidence shows crashes.
Technical view
After rtnl_link_ops was set for IPoIB interfaces, default_device_exit() could skip an IPoIB device moved into a non-initial network namespace. When that namespace is destroyed, the interface is not restored correctly. The fix sets netns_refund so IPoIB interfaces move back to the initial namespace.
Likely exposure
Exposure appears limited to Linux hosts using RDMA/IPoIB interfaces with network namespace movement on affected kernel versions or unpatched downstream builds. General Linux systems without IPoIB or this namespace behavior are less likely to be affected.
Exploitation context
The source shows a reproducible kernel warning and possible later NULL pointer dereference panic. It does not cite public exploitation, KEV listing, attacker prerequisites, or remote exploitability. KEV is false in the supplied data.
Researcher notes
The evidence supports a reliability and denial-of-service concern, not active exploitation. The CVE record lacks CVSS, CWE, and clear privilege details. The key code behavior is namespace cleanup failing to return IPoIB devices to init netns until netns_refund is set.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Check Linux distribution advisories for backported CVE-2021-47266 fixes.
- Avoid moving IPoIB devices into non-initial namespaces until patched.
- Monitor affected hosts for netdev_exit warnings or shutdown panics.
Validation and detection
- Inventory kernels against the affected versions listed in the CVE data.
- Identify hosts using RDMA/IPoIB interfaces and network namespaces.
- Review kernel package changelogs for the referenced stable commit fixes.
- Check system logs for netdev_exit warnings during namespace cleanup.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47266 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/64f1fb6acc2ab95982fc4334f351d7576c26f313CVE reference, Linux
- https://git.kernel.org/stable/c/67cf4e447b5e5e9e94996cb6812ae2828e0e0e27CVE reference, Linux
- https://git.kernel.org/stable/c/0a672f7d89db2da17ae02733ccc08458be72a6f8CVE reference, Linux
- https://git.kernel.org/stable/c/a3e74fb9247cd530dca246699d5eb5a691884d32CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.