Security readout for executives and security teams
Plain-English summary
CVE-2021-47503 is a Linux kernel crash bug in the pm80xx SCSI driver. If the affected driver reaches a specific initialization error path, the kernel can dereference a null pointer and crash. The documented impact is availability loss, not data theft or tampering.
Executive priority
Address during normal kernel patch cycles, with higher priority for storage infrastructure using this driver. It is a denial-of-service risk, and current sources do not support emergency internet-wide exposure or confirmed exploitation.
Technical view
The pm80xx driver called scsi_remove_host() inside pm8001_alloc() before scsi_add_host() had registered the host. That invalid call ordering can reach device_del() with null state and trigger a kernel NULL pointer dereference during pm8001_pci_probe().
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the pm80xx SCSI driver present and able to reach the vulnerable probe/allocation path. The bundle does not identify remote network exposure or affected distro package names.
Exploitation context
The source bundle marks KEV as false and provides no evidence of active exploitation. CVSS describes local attack vector, low complexity, no privileges, no user interaction, and high availability impact only.
Researcher notes
The public evidence is specific to a driver initialization call-order bug and crash trace. Exact distribution impact, backport status, and practical trigger conditions are not fully described in the bundle; validate against vendor kernels and deployed hardware/driver usage.
Mitigation direction
- Update to a kernel containing the referenced stable fixes.
- Check Linux distribution advisories for backported fixed packages.
- Prioritize hosts using or loading the pm80xx SCSI driver.
- Treat unexplained kernel crashes on storage hosts as operationally urgent.
Validation and detection
- Inventory running kernel versions against the affected ranges in the CVE bundle.
- Confirm vendor kernel changelogs include the referenced stable commits.
- Check whether the pm80xx driver is built, loaded, or required.
- Review kernel logs for pm8001_pci_probe, scsi_remove_host, or NULL pointer crash traces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47503 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.2MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1e434d2687e8bc0b3cdc9dd093c0e9047c0b4addCVE reference, Linux
- https://git.kernel.org/stable/c/f8dccc1bdea7e21b5ec06c957aef8831c772661cCVE reference, Linux
- https://git.kernel.org/stable/c/653926205741add87a6cf452e21950eebc6ac10bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.