Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can crash a system when the ETS traffic scheduler changes class counts and later touches a removed class. The public record describes a NULL pointer dereference, not data theft or remote code execution. Business impact is mainly service disruption on systems using this scheduler.
Executive priority
Prioritize patching where Linux hosts provide critical services and use advanced traffic scheduling. This is not sourced as actively exploited, but a kernel crash can still create material downtime in production.
Technical view
In sch_ets, decreasing DRR classes can leave freed class entries on the round-robin active list. ets_qdisc_dequeue may then call peek through a NULL cl->qdisc pointer, causing a kernel oops. The fix removes classes beyond nbands from the active list while holding the qdisc lock.
Likely exposure
Exposure appears limited to Linux systems running affected kernels with the sch_ets ETS qdisc in use or configurable. The source does not prove remote reachability or define required privileges. Systems without this scheduler path are less likely to be affected.
Exploitation context
The CVE is not listed as KEV, and the supplied sources do not claim active exploitation. The evidence shows a reproducible crash condition in kernel traffic scheduling logic, but not an exploit chain, privilege escalation, or remote attack path.
Researcher notes
Key evidence is the upstream Linux fix narrative and stable commits. Version data in the supplied bundle is incomplete and should be verified against distribution backports. No CVSS, CWE, or exploit-status detail was provided beyond KEV false.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the referenced stable fixes.
- Check distribution advisories for backported CVE-2021-47557 fixes.
- Avoid unnecessary use of sch_ets on exposed production systems until patched.
- Treat kernel crash risk as availability-impacting for critical hosts.
Validation and detection
- Inventory Linux kernel versions across production and network-heavy systems.
- Identify hosts using or loading the sch_ets traffic scheduler.
- Confirm kernel package changelogs include the referenced upstream fixes.
- Regression-test traffic scheduling changes after kernel updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47557 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ae2659d2c670252759ee9c823c4e039c0e05a6f2CVE reference, Linux
- https://git.kernel.org/stable/c/e25bdbc7e951ae5728fee1f4c09485df113d013cCVE reference, Linux
- https://git.kernel.org/stable/c/de6d25924c2a8c2988c6a385990cafbe742061bfCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.