Security readout for executives and security teams
Plain-English summary
CVE-2021-47497 is a Linux kernel bug in the nvmem subsystem. A byte-aligned cell size can trigger undefined shift behavior during a cell read. The public record shows it has been fixed in upstream stable commits, but provides no CVSS score, impact rating, or evidence of active exploitation.
Executive priority
Handle through normal kernel patch management unless local evidence shows crashes on affected hardware. There is no sourced evidence of exploitation or severe impact, but kernel undefined behavior should still be removed from supported fleets.
Technical view
The bug occurs when cell->nbits is a multiple of BITS_PER_BYTE. The mask calculation subtracts one after modulo returns zero, leading to a shift exponent too large for unsigned long. The cited UBSAN trace reaches __nvmem_cell_read through nvmem variable reads during device probing.
Likely exposure
Exposure is likely limited to Linux kernels with the affected nvmem code path and platform/device configurations that read byte-sized nvmem cells. The source lists Linux kernel versions and stable commits, but does not provide distribution-specific package names or a complete affected-device list.
Exploitation context
The supplied sources do not report active exploitation, KEV listing, exploit availability, remote attackability, or privilege escalation. The evidence is a UBSAN runtime fault during kernel/device initialization paths. Treat exploitability and business impact as unproven from the available public record.
Researcher notes
The record lacks CVSS, CWE, exploitability analysis, and distribution mapping. The strongest evidence is the kernel commit description and UBSAN trace. Researchers should focus on whether local kernels contain the nvmem mask guard and whether byte-aligned nvmem cells are present.
Mitigation direction
- Check vendor kernel advisories for CVE-2021-47497 and applicable package updates.
- Update affected Linux kernels to builds containing the referenced stable fixes.
- Prioritize embedded, ChromeOS-like, or hardware-specific fleets using nvmem-backed device configuration.
- Track distribution backports instead of relying only on upstream version strings.
- Avoid custom kernel downgrades that remove the nvmem fix.
Validation and detection
- Confirm each kernel build includes the relevant upstream stable fix commit or vendor backport.
- Review kernel package changelogs for CVE-2021-47497 or the nvmem fix title.
- Search system logs for UBSAN shift-out-of-bounds reports in drivers/nvmem/core.c.
- Inventory devices using nvmem cell reads in board or device-tree configuration.
- Validate patched kernels in hardware test coverage that exercises device probing.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit abcb8d33e4d2215ccde5ab5ccf9f730a59d79d97
- Linux stable commit 60df06bbdf497e37ed25ad40572c362e5b0998df
- Linux stable commit 2df6c023050205c4d04ffc121bc549f65cb8d1df
- Linux stable commit eb0fc8e7170e61eaf65d28dee4a8baf4e86b19ca
- Linux stable commit 0594f1d048d8dc338eb9a240021b1d00ae1eb082
- Linux stable commit 57e48886401b14cd351423fabfec2cfd18df4f66
- Linux stable commit 0e822e5413da1af28cca350cb1cb42b6133bdcae
- Linux stable commit 5d388fa01fa6eb310ac023a363a6cb216d9d8fe9
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47497 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/abcb8d33e4d2215ccde5ab5ccf9f730a59d79d97CVE reference, Linux
- https://git.kernel.org/stable/c/60df06bbdf497e37ed25ad40572c362e5b0998dfCVE reference, Linux
- https://git.kernel.org/stable/c/2df6c023050205c4d04ffc121bc549f65cb8d1dfCVE reference, Linux
- https://git.kernel.org/stable/c/eb0fc8e7170e61eaf65d28dee4a8baf4e86b19caCVE reference, Linux
- https://git.kernel.org/stable/c/0594f1d048d8dc338eb9a240021b1d00ae1eb082CVE reference, Linux
- https://git.kernel.org/stable/c/57e48886401b14cd351423fabfec2cfd18df4f66CVE reference, Linux
- https://git.kernel.org/stable/c/0e822e5413da1af28cca350cb1cb42b6133bdcaeCVE reference, Linux
- https://git.kernel.org/stable/c/5d388fa01fa6eb310ac023a363a6cb216d9d8fe9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.