Security readout for executives and security teams
Plain-English summary
CVE-2021-47592 is a Linux kernel denial-of-service flaw in the stmmac Ethernet driver. A local user with relevant privileges can trigger a kernel NULL pointer crash when deleting a specific tc flower VLAN priority steering rule. The known impact is availability loss, not data theft or tampering.
Executive priority
Treat this as a targeted availability risk for affected Linux network interfaces, not a broad internet-facing compromise. Patch through normal kernel maintenance, with faster handling for appliances, edge systems, or production hosts using stmmac and traffic-control steering.
Technical view
The bug is a CWE-476 NULL pointer dereference in stmmac tc flower deletion for VLAN priority Rx steering. During tc filter delete, the driver used flow_cls_offload_flow_rule() even though that rule is no longer valid for delete operations, leading to a kernel oops in tc_setup_cls().
Likely exposure
Exposure is limited to Linux systems using the stmmac Ethernet driver and tc flower VLAN priority hardware steering. General Linux hosts without this driver or traffic-control configuration are less likely to be affected based on the provided sources.
Exploitation context
The source describes local reproduction using tc traffic-control operations and reports a kernel NULL pointer oops. The CVSS vector is local, low complexity, low privileges, no user interaction, and high availability impact. KEV is false, and no cited source confirms active exploitation.
Researcher notes
Evidence supports a driver-side delete-path NULL dereference with availability impact. The provided bundle does not show confidentiality or integrity impact, remote reachability, or active exploitation. Avoid broad claims beyond stmmac, tc flower, VLAN priority Rx steering, and the referenced Linux stable fixes.
Mitigation direction
- Apply Linux kernel or distribution updates containing the referenced stable fixes.
- Prioritize systems using stmmac Ethernet hardware and tc flower VLAN steering.
- Check vendor kernel advisories before assuming a specific downstream version is fixed.
- Restrict traffic-control administration to trusted operators.
- Monitor affected hosts for kernel oops or unexpected reboots.
Validation and detection
- Inventory Linux hosts using the stmmac Ethernet driver.
- Identify systems using tc flower filters for VLAN priority Rx steering.
- Compare running kernel builds against vendor advisories or referenced stable commits.
- Review logs for stmmac, tc_setup_cls, or NULL pointer oops messages.
- Confirm updated kernels remain stable during normal network policy changes.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47592 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/97cb5c82aa1dd85a39b1bd021c8b5f18af623779CVE reference, Linux
- https://git.kernel.org/stable/c/aeb7c75cb77478fdbf821628e9c95c4baa9adc63CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.