Security readout for executives and security teams
Plain-English summary
This is a Linux kernel availability bug in the mxsfb display driver. When the driver is unloaded, a NULL pointer dereference can crash the system. The practical business impact is local denial of service, not data theft or remote compromise based on the supplied evidence.
Executive priority
Treat as a normal-priority kernel availability fix unless affected embedded or display-dependent systems have high uptime requirements. There is no supplied evidence of remote compromise or active exploitation.
Technical view
The flaw is CWE-476 in Linux DRM mxsfb unload handling. If mxsfb->crtc.funcs is already NULL, drm_irq_uninstall() can call mxsfb_irq_disable() and dereference NULL. Stable fixes mask the IRQ using mxsfb->base, which remains valid.
Likely exposure
Exposure appears limited to Linux systems running affected kernels with the mxsfb DRM driver present and reachable through driver unload paths. The supplied version data is incomplete and should be checked against distributor kernel advisories and backports.
Exploitation context
CVSS shows local attack vector, low complexity, low privileges, no user interaction, and high availability impact. The bundle says KEV is false, and no cited source states active exploitation.
Researcher notes
The record identifies a crash-on-unload condition and three stable kernel references. Affected version boundaries in the supplied bundle are not fully normalized, so validation should rely on exact kernel package provenance and vendor backport status.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Check distribution advisories for backported fixes before relying on upstream version numbers.
- Avoid unloading the mxsfb driver on affected systems until patched.
- Restrict local access capable of triggering driver or module unload behavior.
Validation and detection
- Inventory Linux kernel versions on systems using the mxsfb DRM driver.
- Check whether mxsfb is built, loaded, or operationally required.
- Compare vendor kernel packages against the referenced stable commits.
- Confirm monitoring covers unexpected kernel crashes or display-driver unload events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47471 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f40c2281d2c0674d32ba732fee45222d76495472CVE reference, Linux
- https://git.kernel.org/stable/c/b0e6db0656ddfd8bb57303c2ef61ee1c1cc694a8CVE reference, Linux
- https://git.kernel.org/stable/c/3cfc183052c3dbf8eae57b6c1685dab00ed3db4aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.