Security readout for executives and security teams
Plain-English summary
This is a Linux kernel wireless-driver reliability flaw. Systems using the mwifiex driver can hang during driver removal or firmware reset because teardown takes locks in an unsafe order. The business impact is likely availability disruption on affected wireless-enabled Linux devices, not data theft based on the provided evidence.
Executive priority
Treat as targeted operational maintenance. Patch affected Linux wireless systems through normal kernel update channels, faster for appliances or field devices where Wi-Fi driver hangs could require manual recovery.
Technical view
The mwifiex teardown path can deadlock when cfg80211_unregister_wdev() brings the link down while the same wiphy mutex is already held. The resolved behavior brings the link down before deleting the virtual interface, matching nl80211_del_interface() handling for a similar lock-order case.
Likely exposure
Exposure appears limited to Linux systems running affected kernel builds with the mwifiex driver and relevant Marvell Wi-Fi hardware or interfaces. The source bundle identifies Linux 5.12-era affected versions and stable fixes, but does not provide distribution-specific package status.
Exploitation context
The provided sources show a deadlock during rmmod or firmware reset and include a sample hung-task trace. They do not show active exploitation, remote exploitability, privilege requirements, or weaponized public exploit details. KEV status is false.
Researcher notes
Evidence supports a kernel availability deadlock in mwifiex teardown, fixed by changing interface deletion order. No CVSS, CWE, exploit status, or distribution mapping is provided. Version interpretation should be confirmed against vendor kernel backports before declaring systems vulnerable.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Prioritize devices using mwifiex wireless hardware or firmware reset workflows.
- Check distribution advisories for exact backported package versions.
- Avoid unnecessary mwifiex driver unloads until patched where practical.
Validation and detection
- Inventory Linux kernel versions and loaded mwifiex modules.
- Identify systems with Marvell mwifiex wireless interfaces.
- Confirm kernel package includes one of the referenced stable fixes.
- Review logs for hung tasks during rmmod or firmware reset.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47349 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a3041d39d3c14da97fa3476835aba043ba810cf0CVE reference, Linux
- https://git.kernel.org/stable/c/35af69c7c0490fdccfc159c6a87e4d1dc070838aCVE reference, Linux
- https://git.kernel.org/stable/c/1f9482aa8d412b4ba06ce6ab8e333fb8ca29a06eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.