Security readout for executives and security teams
Plain-English summary
This Linux kernel issue is a Btrfs memory leak on certain failure paths. Under specific write or defragmentation conditions, allocated memory may not be released. The sources do not show remote exploitation, active exploitation, CVSS scoring, or confirmed business impact beyond kernel memory leakage.
Executive priority
Treat this as routine kernel hygiene unless Btrfs is heavily used on memory-constrained or high-availability systems. There is no source-backed evidence of active exploitation, but patching remains appropriate because kernel memory leaks can degrade reliability.
Technical view
Btrfs fails to free an allocated extent_changeset when btrfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata() fails. The report ties this mainly to the direct I/O write path after commit 65b3c08606e5 and to defrag_one_locked_target(). Stable kernel fixes free the changeset on those failure paths.
Likely exposure
Exposure appears limited to systems running affected Linux kernels with Btrfs in use, especially workloads exercising direct I/O write paths or Btrfs defragmentation. Downstream distribution exposure depends on kernel backports and vendor packaging.
Exploitation context
The provided sources do not claim active exploitation, and CISA KEV status is false. The evidence describes kmemleak findings during filesystem testing, not a public exploit or remote attack path.
Researcher notes
The record lacks CVSS, CWE, and detailed exploitability analysis. The strongest source evidence is the kernel commit narrative: missing extent_changeset_free() calls on specific Btrfs allocation-failure paths. Validate against exact downstream kernel trees, not version strings alone.
Mitigation direction
- Identify systems using Btrfs on Linux kernels matching the affected CVE metadata.
- Prioritize kernel updates from the operating system or distribution vendor.
- Verify whether vendor kernels include the referenced stable fixes or backports.
- Avoid inventing workarounds; follow vendor guidance if patching is delayed.
Validation and detection
- Inventory Linux kernel versions and confirm whether Btrfs filesystems are mounted.
- Check distribution advisories for CVE-2021-47508 backport status.
- Confirm patched kernels include the referenced stable commits or equivalent fixes.
- Review kernel logs and memory-leak diagnostics for repeated Btrfs kmemleak reports.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47508 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ca06c5cb1b6dbfe67655b33c02fc394d65824519CVE reference, Linux
- https://git.kernel.org/stable/c/da5e817d9d75422eaaa05490d0b9a5e328fc1a51CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.