LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47430: x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n

In the Linux kernel, the following vulnerability has been resolved: x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n Commit 3c73b81a9164 ("x86/entry, selftests: Further improve user entry sanity checks") added a warning if AC is set when in the kernel. Commit 662a0221893a3d ("x86/entry: Fix AC assertion") changed the warning to only fire if the CPU supports SMAP. However, the warning can still trigger on a machine that supports SMAP but where it's disabled in the kernel config and when running the syscall_nt selftest, for example: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 49 at irqentry_enter_from_user_mode CPU: 0 PID: 49 Comm: init Tainted: G T 5.15.0-rc4+ #98 e6202628ee053b4f310759978284bd8bb0ce6905 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 RIP: 0010:irqentry_enter_from_user_mode ... Call Trace: ? irqentry_enter ? exc_general_protection ? asm_exc_general_protection ? asm_exc_general_protectio IS_ENABLED(CONFIG_X86_SMAP) could be added to the warning condition, but even this would not be enough in case SMAP is disabled at boot time with the "nosmap" parameter. To be consistent with "nosmap" behaviour, clear X86_FEATURE_SMAP when !CONFIG_X86_SMAP. Found using entry-fuzz + satrandconfig. [ bp: Massage commit message. ]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can trigger an internal warning on x86 systems when the CPU supports SMAP but the kernel has SMAP disabled. The source bundle does not establish data theft, privilege escalation, or active exploitation. Treat it as a kernel stability and configuration correctness issue until vendor severity guidance says otherwise.

Executive priority

Track through normal Linux kernel maintenance unless affected systems show kernel warnings or run custom kernels. No source provided here supports emergency response or active exploitation.

Technical view

The flaw is in x86 entry handling. A warning added for AC-state sanity checks could still fire when SMAP-capable hardware runs a kernel built without CONFIG_X86_SMAP, or where SMAP is disabled at boot. The upstream fix clears X86_FEATURE_SMAP when CONFIG_X86_SMAP is not enabled, matching nosmap behavior.

Likely exposure

Exposure appears limited to Linux x86 kernels in the affected range described by the CVE record, especially SMAP-capable systems with SMAP disabled in kernel configuration or boot settings. Exact downstream exposure depends on distribution kernel backports and build options.

Exploitation context

The bundle says the issue was found with entry-fuzz and satrandconfig. It does not cite public exploitation, KEV inclusion, weaponized use, or a demonstrated attacker impact beyond the kernel warning condition.

Researcher notes

The CVE text is narrowly scoped to feature-bit handling and warning behavior. Severity, CVSS, CWE, exploitability, and security impact are not provided. Research should focus on downstream kernel status, build configuration, and whether warnings indicate operational instability.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fix.
  • Check distribution advisories for backported fixes and package names.
  • Prioritize systems running custom x86 kernels or unusual SMAP settings.
  • Avoid changing SMAP settings without vendor or platform validation.

Validation and detection

  • Inventory Linux x86 kernel versions and distribution patch levels.
  • Check whether CONFIG_X86_SMAP is disabled in custom kernel builds.
  • Review boot parameters for nosmap on affected hosts.
  • Confirm the relevant stable commit is present or backported.
  • Review kernel logs for the cited entry warning pattern.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47430 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3c73b81a9164d0c1b6379d6672d2772a9e95168e, 3c73b81a9164d0c1b6379d6672d2772a9e95168e, 3c73b81a9164d0c1b6379d6672d2772a9e95168eunaffected
LinuxLinux5.8, 0, 5.10.73, 5.14.12, 5.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.