Security readout for executives and security teams
Plain-English summary
CVE-2021-47329 is a Linux kernel availability issue in the megaraid_sas storage driver. If device probing fails, the driver may leak resources instead of cleaning them up. The business risk is service disruption on Linux systems using affected MegaRAID SAS storage paths, not data theft or privilege escalation based on the supplied sources.
Executive priority
Treat as a standard availability remediation item for affected Linux storage hosts. It is not supported as actively exploited by the provided sources, but storage-path instability can become operationally material if affected systems are critical.
Technical view
The flaw is a CWE-400 resource leak in the Linux kernel megaraid_sas PCI probe failure path. When scsi_add_host() or megasas_start_aen() fails, allocated resources were not fully released. CVSS 3.1 is 6.2 with local attack vector and high availability impact, with no confidentiality or integrity impact stated.
Likely exposure
Exposure is most relevant to Linux hosts using the megaraid_sas driver for MegaRAID SAS controllers. The source bundle lists Linux versions including 3.0, 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14 as affected; distro backports need separate confirmation.
Exploitation context
The supplied sources do not show active exploitation, and this CVE is not marked KEV. The CVSS vector indicates local access, low complexity, no required privileges, and availability impact only. No public exploit details are provided in the bundle.
Researcher notes
Analysis should focus on the megaraid_sas probe error paths and whether downstream kernels include the stable cleanup commits. The supplied record does not establish exploitability beyond local availability impact, and it does not identify affected distributions or hardware models.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable megaraid_sas cleanup fix.
- Check Linux distribution advisories for backported fixes on maintained kernel packages.
- Prioritize systems using MegaRAID SAS storage controllers or loading the megaraid_sas driver.
- Apply normal change control because storage driver updates can affect boot and availability.
Validation and detection
- Inventory Linux systems that use MegaRAID SAS controllers or the megaraid_sas driver.
- Compare running kernel packages against vendor advisories and fixed stable commits.
- Review kernel logs for megaraid_sas probe failures and related resource-pressure symptoms.
- Confirm patched systems remain stable through reboot and storage health checks.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 0c6226601c3e191a44a57d8f9f814b7e5c308959
- Linux stable commit 0680db6f41920b2c91c7df3cc9cd5968701a6f74
- Linux stable commit 04b6b9ea80906e3b41ff120b45db31768947cf72
- Linux stable commit e623f79691c5104317669ab36ec316a90c05062f
- Linux stable commit b5438f48fdd8e1c3f130d32637511efd32038152
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47329 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.2MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0c6226601c3e191a44a57d8f9f814b7e5c308959CVE reference, Linux
- https://git.kernel.org/stable/c/0680db6f41920b2c91c7df3cc9cd5968701a6f74CVE reference, Linux
- https://git.kernel.org/stable/c/04b6b9ea80906e3b41ff120b45db31768947cf72CVE reference, Linux
- https://git.kernel.org/stable/c/e623f79691c5104317669ab36ec316a90c05062fCVE reference, Linux
- https://git.kernel.org/stable/c/b5438f48fdd8e1c3f130d32637511efd32038152CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.