Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can crash a system when transparent huge page collapse races with XFS writeback handling. The documented impact is kernel panic, so the business concern is availability, especially for Linux hosts using XFS under relevant kernel versions. The source bundle does not show data theft, privilege escalation, or active exploitation.
Executive priority
Schedule remediation in normal kernel patch cycles, faster for production systems where unexpected reboot or panic has high operational cost. Escalate only if vendor advisories add exploitability or broader impact evidence.
Technical view
collapse_file failed to explicitly reject pages under PG_writeback. For XFS configurations with block size equal to or larger than page size, page->private may be absent, so existing writeback filtering failed. khugepaged could then interact with a writeback page and trigger an end_page_writeback BUG/panic. The fix bails out early for writeback pages.
Likely exposure
Exposure is most likely on Linux systems using affected kernel builds, transparent huge pages, and XFS with relevant block-size conditions. The CVE data lists Linux affected entries including 5.4, 5.10.77, 5.14.16, and 5.15, but distribution backport status must be confirmed.
Exploitation context
The provided sources describe a reliability bug leading to kernel panic. They do not identify active exploitation, a public exploit, remote reachability, or attacker prerequisites. KEV is false in the supplied bundle, so treat this as an availability-risk kernel maintenance issue.
Researcher notes
The evidence supports a denial-of-service style kernel panic, not confidentiality or integrity impact. The affected-version data in the bundle is sparse and should be reconciled against distro kernel changelogs and the three kernel.org stable commits before final scoping.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes.
- Confirm distribution advisories because backports may change version exposure.
- Prioritize reboot windows for XFS-backed Linux hosts running affected kernels.
- If patching is delayed, ask the vendor for supported operational mitigations.
- Track kernel.org stable commits listed in the CVE references.
Validation and detection
- Inventory Linux kernel versions across XFS-backed systems.
- Check whether installed kernels include the referenced stable commits.
- Identify hosts using transparent huge pages and XFS workloads.
- Review crash logs for khugepaged, collapse_file, or end_page_writeback panics.
- Verify patched hosts after reboot report the expected kernel build.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47492 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/69a7fa5cb0de06c8956b040f19a7248c8c8308caCVE reference, Linux
- https://git.kernel.org/stable/c/5e669d8ab30ab61dec3c36e27b4711f07611e6fcCVE reference, Linux
- https://git.kernel.org/stable/c/74c42e1baacf206338b1dd6b6199ac964512b5bbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.