Security readout for executives and security teams
Plain-English summary
This is a Linux kernel flaw in the mISDN HFC driver cleanup path. Under affected conditions, a timer may continue running after driver removal and touch freed memory. The main business risk is local system instability or unauthorized modification of kernel memory on systems using the affected driver.
Executive priority
Prioritize remediation where affected kernels run on systems with telephony, ISDN, or specialized hardware support. Broader enterprise urgency depends on whether the mISDN HFC driver is present. Patch through normal kernel update channels after exposure validation.
Technical view
CVE-2021-47356 is a CWE-416 use-after-free in HFC_cleanup(). The vulnerable remove path used del_timer(), which does not wait for a running timer handler to finish. The resolved fix replaces it with del_timer_sync(), preventing the handler from running after driver cleanup.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with the mISDN HFC driver present or in use. Systems without this driver or hardware path are less likely to be reachable, but kernel package status should be verified.
Exploitation context
The CVSS vector is local, low complexity, no privileges, and no user interaction. The provided sources do not show CISA KEV listing or confirmed active exploitation. Treat exploit status as unconfirmed, not active.
Researcher notes
The evidence supports a kernel timer lifecycle bug fixed by synchronizing timer deletion during driver cleanup. The source bundle does not provide proof-of-concept details, affected distribution packages, or exploitation telemetry. Analysis should stay branch- and vendor-specific.
Mitigation direction
- Apply Linux kernel updates containing the referenced stable mISDN fix.
- Prioritize affected systems where mISDN or HFC hardware support is enabled.
- If patching is delayed, check distribution vendor guidance for supported interim controls.
- Avoid relying on unverified workarounds not named by the vendor or kernel sources.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and embedded systems.
- Check whether the mISDN HFC driver is built, packaged, or loaded.
- Confirm the deployed kernel includes the referenced stable fix commit for its branch.
- Review vendor advisories for distribution-specific fixed package versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47356 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H2.55.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.7HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/49331c07ef0f8fdfa42b30ba6a83a657b29d7fbeCVE reference, Linux
- https://git.kernel.org/stable/c/54ff3202928952a100c477248e65ac6db01258a7CVE reference, Linux
- https://git.kernel.org/stable/c/7867ddc5f3de7f289aee63233afc0df4b62834c5CVE reference, Linux
- https://git.kernel.org/stable/c/5f2818185da0fe82a932f0856633038b66faf124CVE reference, Linux
- https://git.kernel.org/stable/c/3ecd228c636ee17c14662729737fa07242a93cb0CVE reference, Linux
- https://git.kernel.org/stable/c/b7ee9ae1e0cf55a037c4a99af2acc5d78cb7802dCVE reference, Linux
- https://git.kernel.org/stable/c/61370ff07e0acc657559a8fac02551dfeb9d3020CVE reference, Linux
- https://git.kernel.org/stable/c/ed7c3739d0a07e2ec3ccbffe7e93cea01c438cdaCVE reference, Linux
- https://git.kernel.org/stable/c/009fc857c5f6fda81f2f7dd851b2d54193a8e733CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.