Security readout for executives and security teams
Plain-English summary
This Linux kernel UBIFS flaw can deadlock filesystem work during a specific rename whiteout and inode writeback race. A local low-privileged user or process could cause affected systems to hang tasks, creating an availability outage. The sources do not indicate data theft, privilege escalation, or active exploitation.
Executive priority
Treat as a moderate availability risk. It is not shown as exploited and is local-only, but affected UBIFS systems could experience service disruption. Patch during normal kernel maintenance unless the environment depends heavily on UBIFS with untrusted local workloads.
Technical view
The issue is a CWE-667 improper locking deadlock in UBIFS. During concurrent rename whiteout and writeback, one path holds UBIFS inode mutexes while waiting for writeback that later tries to lock the same mutex. The fix budgets whiteout space before locking UBIFS inodes.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with UBIFS in use and local users or workloads able to perform rename whiteout operations under constrained space conditions.
Exploitation context
CVE data rates this AV:L/PR:L/UI:N with availability impact only. KEV is false, and the provided sources do not report active exploitation. The public description references a reproducer concept, but evidence remains limited to local deadlock conditions.
Researcher notes
Focus triage on UBIFS-enabled deployments and kernel backport status. The affected behavior depends on concurrent rename whiteout, inode writeback, and space pressure. Avoid assuming broader filesystem impact unless vendor advisories confirm it.
Mitigation direction
- Update affected Linux kernels using vendor or distribution guidance.
- Prioritize systems using UBIFS where local users or untrusted workloads can write files.
- Review kernel stable fixes referenced by the CVE for applicable backports.
- If patching is delayed, reduce untrusted local write access to UBIFS-backed paths.
Validation and detection
- Inventory Linux kernel versions and identify systems using UBIFS.
- Confirm whether vendor kernel packages include the referenced stable fixes.
- Check monitoring for hung tasks involving UBIFS writeback or rename paths.
- Validate patched systems no longer run affected kernel builds.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-667: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47637 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9dddc8211430fb851ddf0b168e3a00c6f66cc185CVE reference, Linux
- https://git.kernel.org/stable/c/37bdf1ad592555ecda1d55b89f6e393e4c0589d1CVE reference, Linux
- https://git.kernel.org/stable/c/83e42a78428fc354f5e2049935b84c8d8d29b787CVE reference, Linux
- https://git.kernel.org/stable/c/c58af8564a7b08757173009030b74baf4b2b762bCVE reference, Linux
- https://git.kernel.org/stable/c/70e9090acc32348cedc5def0cd6d5c126efc97b9CVE reference, Linux
- https://git.kernel.org/stable/c/8b278c8dcfb565cb65eceb62a38cbf7a7c326db5CVE reference, Linux
- https://git.kernel.org/stable/c/afd427048047e8efdedab30e8888044e2be5aa9cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.