Security readout for executives and security teams
Plain-English summary
This is a Linux kernel NFC bug that can trigger a null pointer crash when memory allocation fails during device listing cleanup. The public record does not show active exploitation, CVSS, or complete attacker prerequisites. Treat it mainly as a stability and denial-of-service risk until vendor guidance clarifies impact.
Executive priority
Patch during normal kernel maintenance unless the environment has broad local-user exposure, untrusted workloads, or required NFC services. Escalate priority if a vendor rates the issue higher for your distribution or confirms an easier trigger path.
Technical view
The flaw is in nfc_genl_dump_devices_done(). If kmalloc fails in nfc_genl_dump_devices(), cleanup can call class_dev_iter_exit through an uninitialized or null iterator path, causing a KASAN null-ptr-deref during netlink socket destruction. Kernel stable commits are listed as remediation references.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with NFC kernel functionality present. The source does not establish remote reachability, privilege requirements, or whether NFC hardware must be present. Distribution kernels may have backported fixes, so version-only checks can be misleading.
Exploitation context
No CISA KEV listing is provided and the source bundle gives no evidence of active exploitation or public weaponization. The supplied trace shows a crash condition under allocation failure, not a complete exploit path. Practical exploitation likelihood is therefore uncertain from these sources.
Researcher notes
The public record is sparse: no CVSS, CWE, exploit status, or detailed preconditions are supplied. Analysis should focus on validating affected kernel lines, the NFC generic netlink path, vendor backports, and whether the crash is user-triggerable in the target configuration.
Mitigation direction
- Apply vendor or distribution kernel updates that include the referenced stable fixes.
- Check vendor advisories before assuming upstream version numbers reflect backported patch status.
- Reduce unnecessary NFC kernel exposure where operationally feasible.
- Prioritize systems where local users or workloads can interact with NFC generic netlink paths.
Validation and detection
- Inventory Linux kernel versions and distribution patch levels across affected assets.
- Confirm whether the referenced stable commits are present or backported by the vendor.
- Review kernel configuration and loaded modules for NFC support.
- Check kernel logs for null pointer dereferences involving nfc_genl_dump_devices_done.
- Track CVE updates for CVSS, affected-version clarification, or vendor-specific guidance.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit ea55b3797878752aa076b118afb727dcf79cac34
- Linux stable commit 214af18abbe39db05beb305b2d11e87d09a6529c
- Linux stable commit 6644989642844de830f9b072cd65c553cb55946c
- Linux stable commit 2a8845b9603c545fddd17862282dc4c4ce0971e3
- Linux stable commit d731ecc6f2eaec68f4ad1542283bbc7d07bd0112
- Linux stable commit c602863ad28ec86794cb4ab4edea5324f555f181
- Linux stable commit d89e4211b51752daf063d638af50abed2fd5f96d
- Linux stable commit fd79a0cbf0b2e34bcc45b13acf962e2032a82203
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47612 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ea55b3797878752aa076b118afb727dcf79cac34CVE reference, Linux
- https://git.kernel.org/stable/c/214af18abbe39db05beb305b2d11e87d09a6529cCVE reference, Linux
- https://git.kernel.org/stable/c/6644989642844de830f9b072cd65c553cb55946cCVE reference, Linux
- https://git.kernel.org/stable/c/2a8845b9603c545fddd17862282dc4c4ce0971e3CVE reference, Linux
- https://git.kernel.org/stable/c/d731ecc6f2eaec68f4ad1542283bbc7d07bd0112CVE reference, Linux
- https://git.kernel.org/stable/c/c602863ad28ec86794cb4ab4edea5324f555f181CVE reference, Linux
- https://git.kernel.org/stable/c/d89e4211b51752daf063d638af50abed2fd5f96dCVE reference, Linux
- https://git.kernel.org/stable/c/fd79a0cbf0b2e34bcc45b13acf962e2032a82203CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.