LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47506: nfsd: fix use-after-free due to delegation race

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-47506 is a Linux kernel NFS server bug where a timing race can leave freed delegation data referenced later. The public record describes later use-after-free or list-corruption warnings, usually in an internal maintenance thread. Severity, CVSS, and real-world exploit evidence are not provided in the supplied sources.

Executive priority

Treat this as a kernel maintenance priority for Linux NFS servers, not an emergency based on current evidence. Patch through normal vulnerability windows, faster for internet-facing or business-critical NFS infrastructure. Evidence is incomplete for exploitability and severity.

Technical view

The flaw is in Linux nfsd delegation handling. A delegation break can occur after vfs_setlease, adding the delegation to del_recall_lru before nfs4_set_delegation finishes hashing it. If setup exits at that point, the object can be freed without removal from the recall list, causing later use-after-free or list corruption.

Likely exposure

Exposure is most relevant to Linux systems running the kernel NFS server with affected kernel versions and delegation behavior. The source lists Linux as affected across multiple kernel series, but does not provide distribution-specific package status, default exposure, or configuration prerequisites beyond nfsd delegation handling.

Exploitation context

The source bundle does not report active exploitation, KEV listing, exploit availability, or a CVSS score. The described impact is kernel memory safety corruption observed later as warnings, not a documented remote-code-execution or privilege-escalation outcome in the supplied evidence.

Researcher notes

Focus review on nfsd delegation race handling around vfs_setlease, nfs4_set_delegation, nfsd4_cb_recall_prepare, and del_recall_lru cleanup. The source says the issue may predate v3.0, but the exact introduction point is uncertain.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable Linux fixes.
  • Prioritize systems running Linux NFS server workloads.
  • If NFS is unnecessary, disable the NFS server until updated.
  • Check distribution advisories for exact fixed package versions.
  • Schedule reboot or live-patching according to normal kernel update process.

Validation and detection

  • Inventory Linux hosts running nfsd or NFS server roles.
  • Compare kernel versions against vendor advisories for CVE-2021-47506.
  • Confirm deployed kernels include one of the referenced stable fixes.
  • Review kernel logs for use-after-free or list corruption warnings.
  • Verify NFS service exposure is limited to intended networks.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47506 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdff1399f8addf7129c49bb2227469da79cc30b47, dff1399f8addf7129c49bb2227469da79cc30b47, dff1399f8addf7129c49bb2227469da79cc30b47, dff1399f8addf7129c49bb2227469da79cc30b47, dff1399f8addf7129c49bb2227469da79cc30b47, dff1399f8addf7129c49bb2227469da79cc30b47, dff1399f8addf7129c49bb2227469da79cc30b47, dff1399f8addf7129c49bb2227469da79cc30b47unaffected
LinuxLinux3.17, 0, 4.4.296, 4.9.294, 4.14.259, 4.19.222, 5.4.168, 5.10.85, 5.15.8, 5.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.