LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47467: kunit: fix reference count leak in kfree_at_end

In the Linux kernel, the following vulnerability has been resolved: kunit: fix reference count leak in kfree_at_end The reference counting issue happens in the normal path of kfree_at_end(). When kunit_alloc_and_get_resource() is invoked, the function forgets to handle the returned resource object, whose refcount increased inside, causing a refcount leak. Fix this issue by calling kunit_alloc_resource() instead of kunit_alloc_and_get_resource(). Fixed the following when applying: Shuah Khan <skhan@linuxfoundation.org> CHECK: Alignment should match open parenthesis + kunit_alloc_resource(test, NULL, kfree_res_free, GFP_KERNEL, (void *)to_free);

MediumCVSS 5.3Not KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a resource-management bug in KUnit, the kernel testing framework. A reference count can leak during normal kfree_at_end() handling, potentially reducing availability. The supplied sources do not show data exposure, integrity impact, active exploitation, or a production workload trigger.

Executive priority

Handle through normal kernel patch governance, with moderate priority for availability-sensitive environments. There is no cited active exploitation or confidentiality impact, but kernel maintenance should not ignore refcount leaks because they can accumulate into reliability problems.

Technical view

kfree_at_end() used kunit_alloc_and_get_resource(), which increments a resource reference count. The returned resource was not handled, causing a refcount leak. The fix changes this path to kunit_alloc_resource(), avoiding the extra reference. CVSS is 5.3 with availability-only impact.

Likely exposure

Exposure is most relevant to Linux kernels in the affected version range or commit lineage that include the vulnerable KUnit code. The source bundle lists Linux kernel 5.14, 5.14.15, 5.15, and commit 1d71307a6f94. Evidence for broad production exposure is incomplete.

Exploitation context

No source in the bundle reports active exploitation, and the CVE is not listed as KEV. The available description is a kernel resource leak, not a demonstrated exploit chain. Treat it as an availability-risk maintenance item unless vendor guidance indicates higher operational exposure.

Researcher notes

The issue is narrowly described as a KUnit refcount leak in kfree_at_end(). The source evidence supports the root cause and fix direction but does not provide exploitability details, affected distribution packages, or operational trigger conditions. Validate against exact kernel source history before scoring local risk.

Mitigation direction

  • Update affected Linux kernels to versions containing the referenced stable fixes.
  • Check Linux distribution advisories for packaged kernel backports and exact fixed builds.
  • Prioritize systems where KUnit is enabled or kernel test paths run regularly.
  • Avoid inventing local mitigations; follow kernel or distribution vendor guidance.

Validation and detection

  • Inventory kernel versions and compare them with vendor fixed-version guidance.
  • Review whether KUnit is built or enabled in relevant kernel configurations.
  • Confirm the referenced stable commits are present in your kernel source or package changelog.
  • Track distribution advisories for CVE-2021-47467 remediation status.
Prepared
Confidence
medium
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47467 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L3.91.4CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

5.3Medium
CVSS 3.1 vector shape for CVE-2021-47467Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1d71307a6f94df3750f8f884545a769e227172fe, 1d71307a6f94df3750f8f884545a769e227172feunaffected
LinuxLinux5.14, 0, 5.14.15, 5.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.