Security readout for executives and security teams
Plain-English summary
CVE-2021-47295 is a Linux kernel availability issue. A memory leak in the network scheduler tcindex cleanup path can leave allocated hash memory unreleased. The published CVSS score is 7.5 high, focused on availability, not data theft or modification.
Executive priority
Treat as a high-priority availability risk for Linux infrastructure, especially systems where downtime is costly. There is no source-backed evidence of active exploitation, so prioritize patch validation and kernel lifecycle management over emergency incident response.
Technical view
The defect is in tcindex_partial_destroy_work(). During tcindex_set_parms(), new tcindex_data is allocated and old fields are copied, but the perfect hash is not copied. The old tcindex_data destroy path did not free that perfect hash, causing a memory leak reported by syzbot.
Likely exposure
Exposure is Linux systems running affected kernel versions listed in the CVE data. The source bundle ties the issue to net scheduler tcindex code, but does not fully describe deployment prerequisites, configuration requirements, or distribution backport status.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation. The CVSS vector rates it network-accessible, low complexity, no privileges, no user interaction, with high availability impact. No exploit procedure or proof-of-concept details are provided.
Researcher notes
Evidence supports a CWE-400 resource-consumption flaw in Linux net scheduler tcindex cleanup. The source bundle names stable kernel commits but does not provide exploitability prerequisites, affected configurations, or downstream vendor package mappings.
Mitigation direction
- Update affected Linux kernels to versions containing the referenced stable commits.
- Check Linux distribution advisories for backported fixes and corrected package versions.
- Prioritize systems where kernel availability loss would cause service outage.
- Track vendor guidance if your kernel is custom-built or heavily backported.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and container hosts.
- Compare kernel builds against the affected versions and referenced stable commits.
- Review distribution changelogs for the tcindex_partial_destroy_work memory leak fix.
- Confirm production systems are not relying on an unfixed custom kernel build.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 53af9c793f64
- Linux stable commit 01d0d2b8b4e3
- Linux stable commit 8d7924ce85ba
- Linux stable commit 7a6fb69bbcb2
- Linux stable commit 8e9662fde6d6
- Linux stable commit 18c3fa7a7fdb
- Linux stable commit cac71d27745f
- Linux stable commit f5051bcece50
- Linux stable commit 7c183dc0af47
- Linux stable commit 3abebc503a51
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47295 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/53af9c793f644d5841d84d8e0ad83bd7ab47f3e0CVE reference, Linux
- https://git.kernel.org/stable/c/01d0d2b8b4e3cf2110baba9371c0c3d04ad5c77bCVE reference, Linux
- https://git.kernel.org/stable/c/8d7924ce85bae64e7a67c366c7c50840f49f3a62CVE reference, Linux
- https://git.kernel.org/stable/c/7a6fb69bbcb21e9ce13bdf18c008c268874f0480CVE reference, Linux
- https://git.kernel.org/stable/c/8e9662fde6d63c78eb1350f6167f64c9d71a865bCVE reference, Linux
- https://git.kernel.org/stable/c/18c3fa7a7fdbb4d21dafc8a7710ae2c1680930f6CVE reference, Linux
- https://git.kernel.org/stable/c/cac71d27745f92ee13f0ecc668ffe151a4a9c9b1CVE reference, Linux
- https://git.kernel.org/stable/c/f5051bcece50140abd1a11a2d36dc3ec5484fc32CVE reference, Linux
- https://git.kernel.org/stable/c/7c183dc0af472dec33d2c0786a5e356baa8cad19CVE reference, Linux
- https://git.kernel.org/stable/c/3abebc503a5148072052c229c6b04b329a420ecdCVE reference, Linux
- https://git.kernel.org/stable/c/372ae77cf11d11fb118cbe2d37def9dd5f826abdCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.