Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can crash affected systems when a UBIFS rename whiteout operation hits a space-budget failure path. The issue is a double free, meaning kernel memory is released twice. The CVSS impact is availability only, but a crash on affected systems can still disrupt operations.
Executive priority
Treat as a moderate operational reliability risk. Prioritize patching where affected Linux systems use UBIFS in production, embedded, or appliance-like roles. Lower urgency is reasonable for systems without UBIFS exposure or where vendor kernels already include the stable fix.
Technical view
CVE-2021-47638 is a CWE-415 double free in UBIFS rename_whiteout handling. whiteout_ui->data could be freed on the error path, then freed again during inode cleanup through ubifs_free_inode(). KASAN showed the double free in ubifs_free_inode(). The fix leaves that cleanup to ubifs_free_inode().
Likely exposure
Relevant exposure is Linux systems running affected kernel builds with UBIFS in use. The source lists local attack vector and low privileges required. Systems not using UBIFS or already carrying the referenced stable fixes are less likely to be exposed.
Exploitation context
The CVE is not listed as CISA KEV in the provided bundle, and no cited source claims active exploitation. Exploitation requires local access with privileges sufficient to trigger the vulnerable filesystem behavior. The documented security impact is high availability impact, not confidentiality or integrity loss.
Researcher notes
Evidence supports a local availability-impact double free in UBIFS error handling. The source bundle provides kernel stable references and KASAN trace details, but does not provide exploit proof, active exploitation, or product-specific distribution advisories. Validate exposure by filesystem use and backport status.
Mitigation direction
- Apply vendor kernel updates that include the referenced UBIFS stable fixes.
- Confirm distribution kernels have backported the relevant fix, not just a higher version string.
- Prioritize systems that mount or depend on UBIFS for operational workloads.
- If no update is available, follow vendor guidance for temporary risk reduction.
- Limit local access on affected UBIFS systems until remediation is complete.
Validation and detection
- Inventory Linux kernel versions and vendor patch levels across affected assets.
- Identify systems where UBIFS is mounted, loaded, or required by the platform.
- Map installed kernels against the CVE record and referenced stable commits.
- Review crash, KASAN, or kernel logs for UBIFS double-free indicators.
- Confirm remediation through vendor advisory status or fixed kernel package metadata.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-415: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47638 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8b3c7be16f3f4dfd6e15ac651484e59d3fa36274CVE reference, Linux
- https://git.kernel.org/stable/c/2b3236ecf96db7af5836e1366ce39ace8ce832faCVE reference, Linux
- https://git.kernel.org/stable/c/14276d38c89a170363e90b6ac0a53c3cf61b87fcCVE reference, Linux
- https://git.kernel.org/stable/c/a90e2dbe66d2647ff95a0442ad2e86482d977fd8CVE reference, Linux
- https://git.kernel.org/stable/c/2ad07009c459e56ebdcc089d850d664660fdb742CVE reference, Linux
- https://git.kernel.org/stable/c/b9a937f096e608b3368c1abc920d4d640ba2c94fCVE reference, Linux
- https://git.kernel.org/stable/c/6d7a158a7363c1f6604aa47ae1a280a5c65123ddCVE reference, Linux
- https://git.kernel.org/stable/c/40a8f0d5e7b3999f096570edab71c345da812e3eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Double Free
Double Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.