Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash systems using Multipath TCP when an unsupported TCP upper-layer protocol option is applied in a fallback connection path. The public record describes a kernel null-pointer dereference found by syzbot. No CVSS score, KEV listing, or active exploitation evidence is provided.
Executive priority
Treat as a targeted kernel availability risk. It is not KEV-listed and lacks a CVSS score, but kernel crashes can affect service reliability on exposed Linux infrastructure.
Technical view
MPTCP internally uses TCP_ULP to connect TCP subflow sockets to the MPTCP layer. The fix removes user-facing TCP_ULP setsockopt handling for MPTCP because syzbot triggered a null-pointer dereference through mptcp_setsockopt, tcp_set_ulp, and TLS protocol setup during fallback mode.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions with MPTCP support. The bundle lists Linux 5.13-era affected versions and stable kernel fixes, but exact downstream distribution status must be checked with vendor advisories.
Exploitation context
The sources show a syzbot-triggered crash, not a public exploit or in-the-wild activity. CISA KEV status is false. The available evidence supports availability risk, but does not establish remote exploitability or privilege requirements.
Researcher notes
Evidence is narrow: the public description names the crashing call path and states the design conflict around TCP_ULP on MPTCP sockets. It does not provide a full affected-version matrix, exploitability assessment, or distro-specific remediation status.
Mitigation direction
- Upgrade to a kernel containing the referenced stable fixes.
- Check Linux distribution advisories for backported fixes.
- Disable or avoid MPTCP where operationally feasible until patched.
- Prioritize shared or untrusted workload hosts if MPTCP is enabled.
Validation and detection
- Inventory kernel versions across Linux hosts.
- Verify whether MPTCP is enabled or used in production.
- Confirm vendor packages include the referenced stable commits.
- Review crash logs for MPTCP, TCP_ULP, or TLS null dereference traces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47591 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3de0c86d42f841d1d64f316cd949e65c566f0734CVE reference, Linux
- https://git.kernel.org/stable/c/404cd9a22150f24acf23a8df2ad0c094ba379f57CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.