Security readout for executives and security teams
Plain-English summary
CVE-2021-47435 is a Linux kernel Device Mapper race condition that can crash the kernel during I/O completion while a Device Mapper table is being swapped. The public record does not provide CVSS scoring or active exploitation evidence, so urgency depends on exposure to affected Linux kernels and operational reliance on Device Mapper storage.
Executive priority
Treat as a maintenance-priority availability risk for Linux storage infrastructure. Escalate if affected systems host critical workloads, use Device Mapper heavily, or have a history of kernel crash sensitivity. There is no cited active exploitation signal.
Technical view
The flaw is in dm_io_dec_pending() ordering. end_io_acct() can wake a suspend/resume path before pending I/O cleanup finishes, allowing a concurrent table swap to free mempool state. A later free_io() path can dereference NULL mempool->elements, causing a kernel crash. Fixes reorder cleanup and preserve needed struct dm_io member pointers.
Likely exposure
Exposure is likely on Linux systems running affected kernel builds with Device Mapper enabled, especially storage stacks using DM tables. The source lists Linux kernel impact and stable kernel fixes, but does not identify distributions, appliances, cloud images, or application products.
Exploitation context
The source describes a race condition and crash trace, not a weaponized exploit. KEV is false, and no cited source states active exploitation. Practical triggering appears tied to concurrent Device Mapper table swap activity and I/O completion, but public evidence is incomplete.
Researcher notes
Focus analysis on the Device Mapper I/O completion and suspend/resume race. The record gives a concrete crash path and stable commit references, but lacks CVSS, CWE, distribution mapping, and exploitability detail. Avoid assuming remote reachability or privilege requirements beyond the cited kernel behavior.
Mitigation direction
- Update to a Linux kernel build containing the referenced stable fixes.
- Check distribution vendor advisories for backported fixes before relying on version strings.
- Prioritize systems using Device Mapper for LVM, multipath, encryption, or storage virtualization.
- Plan reboot or live-patching according to the organization’s kernel maintenance process.
- Monitor vendor guidance for any later severity, exploitability, or mitigation updates.
Validation and detection
- Inventory Linux kernel versions on systems using Device Mapper.
- Confirm installed kernel packages include one of the referenced stable fixes or vendor backports.
- Review storage configuration for active Device Mapper usage.
- Check crash logs for NULL pointer dereferences involving mempool_free, clone_endio, or dm_io_dec_pending.
- Verify post-update kernels are running, not merely installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47435 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9fb7cd5c7fef0f1c982e3cd27745a0dec260eaedCVE reference, Linux
- https://git.kernel.org/stable/c/d35aef9c60d310eff3eaddacce301efe877e2b7cCVE reference, Linux
- https://git.kernel.org/stable/c/9e07272cca2ed76f7f6073f4444b1143828c8d87CVE reference, Linux
- https://git.kernel.org/stable/c/ad1393b92e5059218d055bfec8f4946d85ad04c4CVE reference, Linux
- https://git.kernel.org/stable/c/d29c78d3f9c5d2604548c1065bf1ec212728ea61CVE reference, Linux
- https://git.kernel.org/stable/c/6e506f07c5b561d673dd0b0d8f7f420cc48024fbCVE reference, Linux
- https://git.kernel.org/stable/c/d208b89401e073de986dc891037c5a668f5d5d95CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.