Security readout for executives and security teams
Plain-English summary
CVE-2021-47512 is a Linux kernel bug in the fq_pie traffic scheduler. During teardown, an internal timer could rearm itself, causing kernel stalls. The known business impact is availability risk on affected Linux systems; the sources do not show data theft, privilege escalation, or active exploitation.
Executive priority
Schedule remediation through normal kernel patching unless fq_pie is used on critical network paths or kernel stalls are observed. Escalate priority for internet-facing infrastructure, packet-processing hosts, or platforms where host availability is business-critical.
Technical view
The flaw is in net/sched sch_fq_pie.c. fq_pie_destroy() did not stop the adapt_timer rearming before del_timer_sync(), unlike related qdisc cleanup paths. The reported symptom is an RCU self-detected stall in softirq timer handling while fq_pie_timer runs after dismantling.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions where the fq_pie queuing discipline is available or configured. The bundle lists Linux 5.6 and fixes around 5.10.85, 5.15.8, and 5.16; distro backports must be checked separately.
Exploitation context
The source bundle does not identify public exploitation, KEV listing, remote attackability, required privileges, or a complete trigger path. Treat this as a kernel availability issue until vendor advisories or distro security notes provide more context.
Researcher notes
Evidence is limited to the Linux CVE text and stable kernel references. The bug class is a teardown/timer lifecycle error in fq_pie. The sources support availability concern, not confirmed exploitability, attacker prerequisites, or confidentiality impact.
Mitigation direction
- Check the running kernel against vendor advisories and distro backport notes.
- Update to a kernel containing the referenced stable fixes.
- Prioritize systems using custom traffic shaping or fq_pie qdisc configurations.
- If patching is delayed, review vendor guidance for safe operational workarounds.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and container hosts.
- Check whether fq_pie is configured in traffic control policies.
- Confirm installed kernel packages include the stable fix commits or distro equivalents.
- Review kernel logs for RCU stalls or fq_pie timer-related warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47512 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2a51edaf5cc563574878b93d7ef3d5955dda7030CVE reference, Linux
- https://git.kernel.org/stable/c/d86216dfda7c98375f809e26a30bfdaaba21d46eCVE reference, Linux
- https://git.kernel.org/stable/c/61c2402665f1e10c5742033fce18392e369931d7CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.