Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw affects virtio I2C handling in virtualized environments. A transfer timeout could leave a virtual device still using memory that the guest already freed, causing corrupted I2C data or guest memory corruption. Business urgency depends on whether affected kernels use virtio-i2c.
Executive priority
Handle as a targeted infrastructure hygiene issue, not a broad emergency. Prioritize patch validation where Linux virtualization stacks use virtio I2C. If virtio-i2c is absent, document non-exposure and continue normal kernel update cadence.
Technical view
The virtio-i2c driver timeout path could free transfer buffers while the backend device continued operating on them. The kernel fix disables timeout handling because a complete safe fix would require persistent bounce buffers until device completion. The source documents memory corruption evidence from slub_debug after a forced backend timeout.
Likely exposure
Exposure appears limited to Linux guests or systems using the virtio I2C driver on affected kernel versions listed in the CVE data. General Linux systems without virtio-i2c usage are less likely to be exposed. Distribution backports may change practical exposure.
Exploitation context
The source bundle does not show active exploitation, CISA KEV listing, public exploit availability, or remote attack details. The documented trigger involved forcing a backend timeout during testing. Treat exploitability as environment-dependent and unproven from these sources.
Researcher notes
Evidence supports a guest memory corruption condition caused by unsafe timeout cleanup in virtio_i2c_xfer. The published remediation disables timeout support rather than redesigning buffer lifetime. The bundle lacks CVSS, CWE, exploit status, and distribution-specific package ranges, so exposure validation must be local.
Mitigation direction
- Update to a vendor or distribution kernel containing the linked upstream stable fixes.
- Prioritize virtualized systems using virtio-i2c or exposing I2C device access to guests.
- Check Linux distribution advisories for backported fixes and affected package versions.
- Avoid assuming a workaround unless your vendor documents one.
- Track kernels in the 5.15 and 5.16 affected range named by the CVE data.
Validation and detection
- Inventory hosts and guests for loaded or built virtio-i2c support.
- Map running kernel versions against vendor advisories and the linked stable commits.
- Confirm patched kernels include the change disabling virtio-i2c timeout handling.
- Review virtualization configurations for virtio I2C devices assigned to guests.
- Monitor kernel logs for I2C transfer errors or memory corruption indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47561 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cc432b0727ce404cc13e8f6b5ce29f412c3f9f1fCVE reference, Linux
- https://git.kernel.org/stable/c/84e1d0bf1d7121759622dabf8fbef4c99ad597c5CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.