Security readout for executives and security teams
Plain-English summary
This is a Linux kernel NFS server startup race that can crash the kernel during mount-related startup handling. The public record does not provide CVSS scoring or evidence of active exploitation. Business urgency depends on whether affected Linux kernels are used on systems running or starting NFS server functionality.
Executive priority
Treat as a targeted stability risk for Linux NFS server infrastructure, not as confirmed active exploitation. Prioritize patch validation on production file-sharing, storage, and infrastructure hosts where kernel crashes would cause service disruption.
Technical view
The issue is in nfsd startup ordering around register_pernet_subsys(), register_cld_notifier(), and rpc_pipefs_event(). A prior ordering change reopened a race against nfsd_net_id registration, leading to a NULL pointer dereference in rpc_pipefs_event() and kernel crash. Stable kernel commits restore the registration order and add WARN_ON() regression protection.
Likely exposure
Likely exposure is Linux systems using affected kernel versions and nfsd-related startup paths. The source bundle names Linux kernel versions and stable commits, but does not provide distribution package mappings, exploit prerequisites, or complete environmental requirements.
Exploitation context
The bundle shows a crash trace triggered during mount processing and marks KEV as false. There is no cited evidence of active exploitation, public weaponization, remote reachability, privilege requirements, or attacker-controlled trigger conditions.
Researcher notes
Evidence is strongest for a kernel NULL pointer crash caused by startup race ordering in nfsd. The record lacks CVSS, CWE, exploitability details, and distro-specific fixed builds. Avoid assuming remote exploitability without additional vendor evidence.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable fixes.
- Check Linux distribution advisories for backported package names and fixed versions.
- Prioritize systems providing NFS server functionality or loading nfsd.
- If updates are delayed, follow vendor guidance for temporary operational workarounds.
Validation and detection
- Inventory Linux kernel versions against the affected versions in the CVE record.
- Identify hosts where nfsd or NFS server functionality is enabled.
- Confirm the deployed kernel includes one of the referenced stable fix commits or vendor backport.
- Review kernel logs for rpc_pipefs_event or nfsd NULL pointer crash signatures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47507 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f5734b1714ca355703e9ea8fb61d04beff1790b9CVE reference, Linux
- https://git.kernel.org/stable/c/c520943a00ad5015704969ad3304c956bcd49d25CVE reference, Linux
- https://git.kernel.org/stable/c/8bf902fee5893cfc2f04a698abab47629699ae9aCVE reference, Linux
- https://git.kernel.org/stable/c/b10252c7ae9c9d7c90552f88b544a44ee773af64CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.