Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory-management flaw in the CPU frequency scheduler governor. Under certain governor change behavior, the kernel could free an object before its kobject lifecycle had safely completed. Business urgency depends on whether affected kernels are deployed; the provided sources do not show remote exposure, active exploitation, or a CVSS score.
Executive priority
Track and patch through normal kernel maintenance unless vendor guidance rates it higher for your environment. Escalate priority for internet-facing appliances, shared hosts, or embedded fleets where kernel updates are slow and local access boundaries matter.
Technical view
The schedutil cpufreq governor freed sugov_tunables directly even though it was protected by a kobject. The kernel fix splits global tunable cleanup from object freeing and uses kobj_type::release so sugov_tunables is released only when safe. The source trace shows debugobjects detecting an active timer/list object during governor policy changes.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions or downstream builds carrying the vulnerable cpufreq schedutil code. The evidence points to local kernel behavior involving CPU frequency governor changes through sysfs, not a remotely reachable service.
Exploitation context
The provided bundle does not cite active exploitation, and KEV is false. No exploit path, privilege requirement, or impact rating is provided. Treat this as a kernel stability and memory-safety issue until vendor advisories or distribution backports clarify practical exploitability.
Researcher notes
The core issue is lifetime management: sugov_tunables must be freed by the kobject release path. The source evidence includes a debugobjects warning during store_scaling_governor and stable commits for multiple kernel branches, but no CVSS, CWE, exploit status, or distribution-specific advisories.
Mitigation direction
- Identify Linux kernel versions and vendor backport status across affected systems.
- Apply kernel updates containing the referenced stable fixes when available from your distribution.
- Check vendor guidance if using appliance, embedded, or custom kernels.
- Prioritize systems where CPU frequency governors are changeable in production.
Validation and detection
- Confirm deployed kernel versions against vendor advisories and CVE metadata.
- Verify whether schedutil cpufreq support is enabled on target systems.
- Review change history for kernel updates containing the referenced stable commits.
- Check logs for related kernel warnings during cpufreq governor changes.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit cb4a53ba37532c861a5f3f22803391018a41849a
- Linux stable commit 463c46705f321201090b69c4ad5da0cd2ce614c9
- Linux stable commit 30d57cf2c4116ca6d34ecd1cac94ad84f8bc446c
- Linux stable commit 67c98e023135ff81b8d52998a6fdb8ca0c518d82
- Linux stable commit a7d4fc84404d45d72f4490417e8cc3efa4af93f1
- Linux stable commit 8d62aec52a8c5b1d25a2364b243fcc5098a2ede9
- Linux stable commit e5c6b312ce3cc97e90ea159446e6bfa06645364d
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47387 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cb4a53ba37532c861a5f3f22803391018a41849aCVE reference, Linux
- https://git.kernel.org/stable/c/463c46705f321201090b69c4ad5da0cd2ce614c9CVE reference, Linux
- https://git.kernel.org/stable/c/30d57cf2c4116ca6d34ecd1cac94ad84f8bc446cCVE reference, Linux
- https://git.kernel.org/stable/c/67c98e023135ff81b8d52998a6fdb8ca0c518d82CVE reference, Linux
- https://git.kernel.org/stable/c/a7d4fc84404d45d72f4490417e8cc3efa4af93f1CVE reference, Linux
- https://git.kernel.org/stable/c/8d62aec52a8c5b1d25a2364b243fcc5098a2ede9CVE reference, Linux
- https://git.kernel.org/stable/c/e5c6b312ce3cc97e90ea159446e6bfa06645364dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.