LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove

In the Linux kernel, the following vulnerability has been resolved: net: qcom/emac: fix UAF in emac_remove adpt is netdev private data and it cannot be used after free_netdev() call. Using adpt after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-47311 is a Linux kernel memory safety bug in the Qualcomm EMAC network driver removal path. The source says driver private data can be used after free_netdev(), creating a use-after-free condition. Business urgency depends on whether your Linux builds include and use this driver.

Executive priority

Prioritize asset identification first. Escalate remediation for internet-facing, embedded, or hard-to-monitor systems using affected Linux kernels with Qualcomm EMAC. Current evidence does not support emergency exploitation claims, but kernel memory bugs can carry operational risk.

Technical view

The issue is in net/qcom/emac emac_remove. The adapter pointer is netdev private data and must not be used after free_netdev(). The kernel fix moves free_netdev() to the end of the function. Supplied data lists multiple Linux kernel versions as affected, but provides no CVSS, CWE, or impact rating.

Likely exposure

Exposure is most likely on Linux systems that include the Qualcomm EMAC driver and run affected kernel versions or downstream kernels carrying the vulnerable code. Generic Linux servers without this driver or hardware path may have no practical exposure, but source data does not provide a complete affected-product matrix.

Exploitation context

The supplied sources do not state active exploitation, and KEV is false. They also do not provide exploitability details, prerequisites, or observed attacks. Treat this as a kernel memory-safety flaw requiring inventory-driven remediation rather than as confirmed in-the-wild exploitation.

Researcher notes

The source bundle provides the root cause and fix strategy but lacks CVSS, CWE, attack vector, and exploitability analysis. Avoid broad claims beyond qcom/emac and the listed Linux kernel data. Downstream distributions may have different version labels due to backports.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fix.
  • Check Linux distribution or device vendor advisories for backported patches.
  • Prioritize appliances or embedded systems using Qualcomm EMAC networking.
  • Reboot into the fixed kernel after applying updates.
  • If patching is delayed, follow vendor guidance for compensating controls.

Validation and detection

  • Identify hosts or firmware builds containing the qcom/emac driver.
  • Compare running kernel versions against vendor-fixed releases or referenced commits.
  • Confirm the patched code moves free_netdev() after final adapter use.
  • Verify systems rebooted into the updated kernel.
  • Document any devices awaiting vendor firmware updates.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47311 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux54e19bc74f3380d414681762ceed9f7245bc6a6e, 54e19bc74f3380d414681762ceed9f7245bc6a6e, 54e19bc74f3380d414681762ceed9f7245bc6a6e, 54e19bc74f3380d414681762ceed9f7245bc6a6e, 54e19bc74f3380d414681762ceed9f7245bc6a6e, 54e19bc74f3380d414681762ceed9f7245bc6a6e, 54e19bc74f3380d414681762ceed9f7245bc6a6eunaffected
LinuxLinux4.9, 0, 4.9.277, 4.14.241, 4.19.199, 5.4.135, 5.10.53, 5.13.5, 5.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.