Security readout for executives and security teams
Plain-English summary
This Linux kernel JFS bug can crash kernel code when JFS cleanup reaches diFree with an uninitialized inode map pointer. The public record does not provide CVSS, confirmed exploitation, or a remote attack path. Business urgency is highest for systems that run affected kernels and mount or accept JFS filesystems.
Executive priority
Schedule remediation through normal kernel patch management, with faster handling for systems using JFS or processing untrusted removable or disk images. Current public evidence does not justify emergency treatment, but the bug is in kernel code and can affect system availability.
Technical view
The flaw is in fs/jfs: diFree() dereferences JFS_SBI(inode->i_sb)->ipimap through JFS_IP(ipimap). When ipimap is NULL, JFS_IP() returns an invalid pointer, leading to a general protection fault during jfs_evict_inode and inode teardown. Linux stable commits are referenced as the resolution.
Likely exposure
Exposure appears limited to Linux systems on affected kernel versions where JFS is enabled and exercised. The source lists affected versions from 2.6.36 through multiple stable branches up to 5.14. Environments that do not use JFS likely have lower practical exposure, but kernel package backports must be checked.
Exploitation context
The CVE source marks KEV as false and provides no cited evidence of active exploitation. It also does not document an exploit vector, privileges required, or whether a crafted filesystem image is needed. Treat this primarily as a kernel stability and availability concern unless vendor advisories provide more detail.
Researcher notes
The public description is narrow: NULL ipimap handling before diFree in JFS inode eviction. There is no CVSS, CWE, exploitability analysis, or distribution-specific advisory in the supplied bundle. Researchers should validate reachability against affected kernel trees and patched commits without assuming a broader impact.
Mitigation direction
- Update to a vendor kernel containing the referenced Linux stable fixes.
- Prioritize hosts that mount, process, or permit JFS filesystems.
- Disable or restrict JFS usage where it is not operationally required.
- Monitor vendor advisories for distribution-specific patched package versions.
- Avoid assuming mitigation coverage from upstream version numbers alone.
Validation and detection
- Inventory kernel versions and distribution patch levels across Linux assets.
- Identify systems with JFS modules loaded or JFS filesystems mounted.
- Map affected systems to vendor advisories or referenced stable commits.
- Review kernel logs for JFS-related general protection faults.
- Confirm patched kernels are running after reboot.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 7bde24bde490
- Linux stable commit 745c9a59422c
- Linux stable commit 49def1b06448
- Linux stable commit aff8d95b6905
- Linux stable commit a21e5cb1a64c
- Linux stable commit 801893695036
- Linux stable commit 3bb27e272402
- Linux stable commit 42f102ea1943
- Linux stable commit 9d574f985fe3
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47340 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7bde24bde490f3139eee147efc6d60d6040fe975CVE reference, Linux
- https://git.kernel.org/stable/c/745c9a59422c63f661f4374ed5181740db4130a1CVE reference, Linux
- https://git.kernel.org/stable/c/49def1b0644892e3b113673c13d650c3060b43bcCVE reference, Linux
- https://git.kernel.org/stable/c/aff8d95b69051d0cf4acc3d91f22299fdbb9dfb3CVE reference, Linux
- https://git.kernel.org/stable/c/a21e5cb1a64c904f1f0ef7b2d386fc7d2b1d2ce2CVE reference, Linux
- https://git.kernel.org/stable/c/8018936950360f1c503bb385e158cfc5e4945d18CVE reference, Linux
- https://git.kernel.org/stable/c/3bb27e27240289b47d3466f647a55c567adbdc3aCVE reference, Linux
- https://git.kernel.org/stable/c/42f102ea1943ecb10a0756bf75424de5d1d5beedCVE reference, Linux
- https://git.kernel.org/stable/c/9d574f985fe33efd6911f4d752de6f485a1ea732CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.