Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory-management flaw in NUMA memory policy handling. A malformed policy combination in mbind() could reach uninitialized memory paths and trigger a kernel fault condition observed by syzbot/KMSAN. Business impact depends on whether exposed systems run affected kernel versions and allow local users or workloads to invoke the vulnerable syscall path.
Executive priority
Treat as a kernel maintenance item with uncertain severity. Prioritize patching internet-facing infrastructure only if it also hosts untrusted local users or workloads. Otherwise, include it in the next controlled Linux kernel update cycle after confirming vendor fix status.
Technical view
The bug was introduced by commit bda420b98505, which added MPOL_F_NUMA_BALANCING but validated its legal pairing only in do_set_mempolicy(). mbind() missed that validation, allowing MPOL_F_NUMA_BALANCING with MPOL_LOCAL and causing uninitialized memory use in __mpol_equal() during VMA merge handling. Stable kernel commits move validation into sanitize_mpol_flags().
Likely exposure
Exposure is limited to Linux systems running affected kernel builds identified in the CVE record. The source bundle does not identify a remote attack surface, affected distributions, container escape impact, or default exploitability. Kernel package backports may change exposure versus upstream version numbers.
Exploitation context
No source in the bundle reports active exploitation, and KEV is false. Evidence comes from syzbot/KMSAN crash reporting and kernel stable fixes. The provided sources do not include public exploit status, privilege requirements, or real-world abuse details.
Researcher notes
The key validation gap is placement of MPOL_F_NUMA_BALANCING checks. Researchers should focus on whether downstream kernels include sanitize_mpol_flags() enforcement for mbind(), not just do_set_mempolicy(). The bundle does not provide CVSS, CWE, exploitability assessment, or distro-specific package status.
Mitigation direction
- Upgrade to a kernel containing the referenced stable fixes.
- Check distribution advisories for backported fixes to packaged kernels.
- Prioritize shared Linux hosts with untrusted local workloads.
- Document the kernel update in normal vulnerability management records.
Validation and detection
- Inventory Linux kernel versions and vendor package build numbers.
- Compare installed kernels against distribution advisories and upstream fixed commits.
- Confirm no systems remain on affected upstream kernel lines listed in the CVE record.
- Review crash telemetry for related mbind(), mempolicy, or KMSAN kernel faults.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47462 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9ee4e9ae98f1f262d6fae0d266cfdf3ba2c321d9CVE reference, Linux
- https://git.kernel.org/stable/c/6d2aec9e123bb9c49cb5c7fc654f25f81e688e8cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.