LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47276: ftrace: Do not blindly read the ip address in ftrace_bug()

In the Linux kernel, the following vulnerability has been resolved: ftrace: Do not blindly read the ip address in ftrace_bug() It was reported that a bug on arm64 caused a bad ip address to be used for updating into a nop in ftrace_init(), but the error path (rightfully) returned -EINVAL and not -EFAULT, as the bug caused more than one error to occur. But because -EINVAL was returned, the ftrace_bug() tried to report what was at the location of the ip address, and read it directly. This caused the machine to panic, as the ip was not pointing to a valid memory address. Instead, read the ip address with copy_from_kernel_nofault() to safely access the memory, and if it faults, report that the address faulted, otherwise report what was in that location.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel availability flaw in the ftrace error-reporting path. When ftrace hit a bad instruction-patching address, the reporting code could read that invalid address directly and panic the machine. The source does not describe data theft, privilege escalation, or remote compromise.

Executive priority

Treat this as a kernel stability remediation item, not an emergency breach indicator. Patch through normal kernel maintenance, with higher urgency for arm64 production systems where unexpected reboot or outage would materially affect service availability.

Technical view

In ftrace_bug(), an -EINVAL path could still dereference the reported instruction pointer. On arm64, a bad IP during ftrace_init() NOP patching could point outside valid kernel memory, causing a panic. The fix uses copy_from_kernel_nofault() and reports a faulting address safely.

Likely exposure

Exposure is likely limited to Linux systems running affected kernel ranges containing the ftrace code path. The bundle indicates Linux kernels before listed stable fixes across 4.4, 4.9, 4.14, 4.19, 5.4, 5.10, 5.12, and 5.13 lines may need validation.

Exploitation context

The source bundle shows KEV is false and gives no evidence of active exploitation. The described impact is a kernel panic during an ftrace initialization error path, not a documented attacker-driven exploit chain.

Researcher notes

The record is specific to an error-handling read in ftrace_bug(). The bundle lacks CVSS, CWE, exploitability analysis, and distribution-specific fixed package data, so validation should focus on kernel source ancestry and vendor backports.

Mitigation direction

  • Upgrade to a vendor kernel containing the referenced stable ftrace fix.
  • Confirm distribution backports rather than relying only on upstream version numbers.
  • Prioritize arm64 Linux systems where ftrace or kernel tracing is enabled.
  • Schedule reboot and rollback planning for kernel updates.
  • Monitor Linux distribution advisories for CVE-2021-47276 handling.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and images.
  • Check vendor changelogs for the ftrace_bug() nofault-read fix.
  • Identify arm64 systems and systems using ftrace or tracing features.
  • Confirm patched kernels are booted, not just installed.
  • Review crash logs for ftrace_init or ftrace_bug kernel panics.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47276 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux05736a427f7e16be948ccbf39782bd3a6ae16b14, 05736a427f7e16be948ccbf39782bd3a6ae16b14, 05736a427f7e16be948ccbf39782bd3a6ae16b14, 05736a427f7e16be948ccbf39782bd3a6ae16b14, 05736a427f7e16be948ccbf39782bd3a6ae16b14, 05736a427f7e16be948ccbf39782bd3a6ae16b14, 05736a427f7e16be948ccbf39782bd3a6ae16b14, 05736a427f7e16be948ccbf39782bd3a6ae16b14unaffected
LinuxLinux2.6.28, 0, 4.4.273, 4.9.273, 4.14.237, 4.19.195, 5.4.126, 5.10.44, 5.12.11, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.