Security readout for executives and security teams
Plain-English summary
A Linux kernel watchdog cleanup bug can leave a timer running after related driver memory has been freed. That creates a use-after-free condition with high confidentiality, integrity, and availability impact in the CVSS record. The source bundle does not show active exploitation.
Executive priority
Prioritize normal high-severity kernel patching, especially for multi-user, exposed, or critical Linux systems. The business risk is meaningful, but this bundle does not justify emergency active-exploitation handling.
Technical view
CVE-2021-47324 fixes a watchdog wdt_startup() use-after-free. The remove path used del_timer(), which does not wait for a running timer handler to finish. The fix uses del_timer_sync() so the handler completes and cannot re-schedule itself after driver removal.
Likely exposure
Exposure is most likely on systems running affected Linux kernel versions or downstream builds without the referenced stable fixes. Distribution backports may alter apparent version exposure, so package-level verification is needed.
Exploitation context
The CVSS vector is 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. KEV is false, and the supplied sources do not cite public exploitation. Treat exploitability as plausible but unconfirmed from this bundle.
Researcher notes
The record attributes the issue to timer teardown semantics in watchdog code. Affected-version metadata is broad and includes commit-style entries, so rely on stable commit presence and distribution backport status rather than upstream version strings alone.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable fixes.
- Check Linux distribution advisories for backported patches.
- Prioritize internet-facing or multi-user Linux systems first.
- Reboot systems after kernel update if required by vendor guidance.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and images.
- Compare installed kernel packages against vendor fixed builds.
- Check package changelogs for the referenced stable commit IDs.
- Confirm vulnerable kernels are retired or patched after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47324 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/63a3dc24bd053792f84cb4eef0168b1266202a02CVE reference, Linux
- https://git.kernel.org/stable/c/862f2b5a7c38762ac9e369daefbf361a91aca685CVE reference, Linux
- https://git.kernel.org/stable/c/0ac50a76cf3cd63db000648b3b19f3f98b8aaa76CVE reference, Linux
- https://git.kernel.org/stable/c/dc9403097be52d57a5c9c35efa9be79d166a78afCVE reference, Linux
- https://git.kernel.org/stable/c/146cc288fb80c662c9c35e7bc58325d1ac0a7875CVE reference, Linux
- https://git.kernel.org/stable/c/a397cb4576fc2fc802562418b3a50b8f67d60d31CVE reference, Linux
- https://git.kernel.org/stable/c/b4ebf4a4692e84163a69444c70ad515de06e2259CVE reference, Linux
- https://git.kernel.org/stable/c/8adbbe6c86bb13e14f8a19e036ae5f4f5661fd90CVE reference, Linux
- https://git.kernel.org/stable/c/c08a6b31e4917034f0ed0cb457c3bb209576f542CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.