Security readout for executives and security teams
Plain-English summary
CVE-2021-47335 is a Linux kernel F2FS filesystem bug. Multiple F2FS filesystem instances can race over a shared slab-cache pointer during recovery, causing a use-after-free write. The sources do not provide CVSS, confirmed exploitation, or business-impact scoring, so urgency depends on whether affected Linux kernels and F2FS are used.
Executive priority
Treat this as a targeted Linux kernel maintenance issue unless F2FS is used in production or embedded fleets. Ask operations to confirm exposure and align patching with normal kernel update cycles unless vendor guidance raises severity.
Technical view
The flaw is in Linux F2FS recovery around fsync_entry_slab lifecycle handling. A global fsync_entry_slab pointer could be initialized or destroyed unsafely across multiple F2FS instances, leading to use-after-free during f2fs_recover_fsync_data. The kernel fix moves slab cache init/destroy to module init/destroy so it happens once.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions where F2FS is enabled and mounted, especially recovery paths involving multiple F2FS filesystem instances. The source bundle does not identify affected distributions, cloud images, appliances, or default configurations.
Exploitation context
The record cites a syzbot-reported use-after-free and marks KEV as false. No provided source states active exploitation, public weaponization, remote reachability, required privileges, or exploit reliability.
Researcher notes
Evidence supports a kernel use-after-free in F2FS recovery caused by cross-instance slab-cache lifecycle racing. Key unknowns are exploitability, privilege requirements, affected distro backports, and whether F2FS is reachable in specific deployments.
Mitigation direction
- Check Linux vendor advisories for a kernel containing the referenced stable fixes.
- Prioritize updates where F2FS is enabled or operationally required.
- Confirm distribution backports rather than relying only on upstream version numbers.
- Avoid exposing unpatched systems to untrusted F2FS media where feasible.
Validation and detection
- Inventory Linux kernel versions across servers, endpoints, and embedded systems.
- Identify systems with F2FS support enabled or F2FS filesystems mounted.
- Map installed kernels to vendor advisories or the referenced stable commits.
- Document systems where F2FS is unused as lower exposure, not automatically unaffected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47335 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/86786603014e0a22d0d6af8e80ae4b8687927048CVE reference, Linux
- https://git.kernel.org/stable/c/79fa5d944c875711253a23b8155b36883c696409CVE reference, Linux
- https://git.kernel.org/stable/c/e472b276a0d2180808009be38105e12754432e2aCVE reference, Linux
- https://git.kernel.org/stable/c/cad83c968c2ebe97905f900326988ed37146c347CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.