Security readout for executives and security teams
Plain-English summary
CVE-2021-47536 is a Linux kernel bug in the SMC networking code. A cleanup path removed the wrong list entry, leaving a real link group in place and later clearing its memory. The reported result is list corruption and a kernel panic. Public severity data is incomplete, so business urgency depends on Linux kernel exposure and SMC use.
Executive priority
Patch during normal kernel maintenance unless SMC is used on critical systems, where priority should increase. There is credible crash risk, but the provided sources do not establish active exploitation or a remote attack path.
Technical view
The flaw is in net/smc smc_lgr_cleanup_early(). It called list_del on the list head rather than the link group entry. The stale entry could later reference memory after the link group structure was memset, causing list corruption in SMC link-down handling and a kernel BUG/panic. Upstream stable commits are listed as fixes.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions or vendor backports that include the vulnerable SMC code. The bundle lists Linux 5.5, 5.10.84, 5.15.7, and 5.16 as affected indicators, but distribution backports may change status.
Exploitation context
The sources show a test-triggered kernel panic and memory corruption condition. They do not show public exploitation, KEV listing, exploit availability, required privileges, or whether remote triggering is practical. Treat active exploitation as unproven based on the provided evidence.
Researcher notes
Focus analysis on smc_lgr_cleanup_early and link group lifecycle handling. The key condition is deletion of the wrong list node, followed by clearing the link group object. Evidence supports memory corruption and panic, but not exploitability beyond denial of service.
Mitigation direction
- Apply Linux vendor kernel updates that include the referenced upstream stable fixes.
- Check distribution advisories before relying on upstream version numbers alone.
- If SMC is unnecessary, evaluate vendor-supported ways to disable or avoid it.
- Prioritize hosts where SMC networking is enabled or used in production.
- Track remediation through kernel package versions and vendor backport notes.
Validation and detection
- Inventory Linux kernel versions across servers, containers hosts, and appliances.
- Confirm whether AF_SMC or SMC-R/SMC-D networking is enabled or used.
- Compare installed kernel packages against vendor advisories for CVE-2021-47536.
- Review kernel logs for list_del corruption or SMC link-down panic signatures.
- Verify the fix commit or vendor backport is present after patching.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47536 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/77731fede297a23d26f2d169b4269466b2c82529CVE reference, Linux
- https://git.kernel.org/stable/c/95518fe354d712dca6f431cf2a11b8f63bc9a66cCVE reference, Linux
- https://git.kernel.org/stable/c/789b6cc2a5f9123b9c549b886fdc47c865cfe0baCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.