LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47600: dm btree remove: fix use after free in rebalance_children()

In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalance_children() Move dm_tm_unlock() after dm_tm_dec().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-47600 is a Linux kernel memory-safety bug in device-mapper btree removal logic. The public record says it is a use-after-free fixed by changing unlock/decrement ordering. No CVSS score, CWE, or active exploitation evidence is provided, so urgency depends on whether exposed systems run affected kernel builds and device-mapper paths.

Executive priority

Treat this as a patch-management item rather than an emergency based on current evidence. It affects Linux kernel code and may matter on critical infrastructure, but the source bundle provides no CVSS score, no exploitation evidence, and no business-impact detail.

Technical view

The vulnerability is in rebalance_children() within Linux kernel dm btree remove handling. The fix moves dm_tm_unlock() after dm_tm_dec(), indicating an object could be unlocked or released in an unsafe order and later reused. Stable kernel commits are referenced across multiple branches, but the supplied data does not describe exploitability, privileges, or impact outcomes.

Likely exposure

Exposure is likely limited to systems running affected Linux kernel versions in the listed stable series and exercising device-mapper btree metadata operations. Internet-facing exposure is not established by the sources. Prioritize Linux servers, appliances, virtualization hosts, and storage-heavy systems where kernel patch levels lag.

Exploitation context

The bundle does not cite public exploitation, weaponized proof-of-concept activity, or CISA KEV listing. Because this is a kernel use-after-free, researchers should treat it as potentially security-relevant, but the provided evidence does not support claims of active attacks or practical exploitability.

Researcher notes

Focus analysis on dm btree remove and rebalance_children() lifetime ordering. The source record only states the fix ordering change, so avoid asserting reachable attack paths, required privileges, or outcomes without additional kernel or vendor evidence.

Mitigation direction

  • Inventory Linux kernel versions across servers, appliances, and container hosts.
  • Compare deployed kernels against vendor advisories and the referenced stable commits.
  • Apply the appropriate vendor kernel update when available.
  • Prioritize systems using Linux device-mapper storage features.
  • If no vendor package is available, follow distribution-specific kernel backport guidance.

Validation and detection

  • Confirm the running kernel version on each in-scope host.
  • Check whether vendor changelogs include CVE-2021-47600 or the referenced commits.
  • Review device-mapper usage on storage-heavy or virtualization systems.
  • Verify patched hosts rebooted into the updated kernel.
  • Track exceptions where vendor guidance is unavailable or ambiguous.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47600 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4unaffected
LinuxLinux3.2, 0, 4.4.296, 4.9.294, 4.14.259, 4.19.222, 5.4.168, 5.10.88, 5.15.11, 5.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.