Security readout for executives and security teams
Plain-English summary
CVE-2021-47640 is a Linux kernel PowerPC KASAN flaw that can make memory errors appear incorrectly or go undetected. The CVSS score is high because local authenticated code could affect confidentiality, integrity, and availability. The provided sources do not show internet-facing exposure or confirmed active exploitation.
Executive priority
Prioritize remediation for PowerPC Linux systems where local users, workloads, or containers can run code. The business urgency is highest for shared, multi-user, or high-trust systems. No active exploitation is shown in the bundle, but kernel-level impact justifies scheduled patching and exposure confirmation.
Technical view
The issue is in PowerPC KASAN early shadow page-table handling when PTE_RPN_SHIFT is 24 and PAGE_SHIFT is 12. Incorrect shadow updates can cause false positives and false negatives, including missed vmalloc out-of-bounds detection in KASAN tests. It is tracked as CWE-787 with CVSS 3.1 score 7.8.
Likely exposure
Exposure appears limited to affected Linux kernel versions or commits, especially PowerPC configurations matching the KASAN conditions described. The bundle lists Linux as affected across several 5.x versions and specific commits. Organizations should map distribution kernels to vendor advisories because downstream backports may differ from upstream version numbers.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation. The CVSS vector is local, low complexity, low privileges, and no user interaction. Treat it as a local kernel risk, not a confirmed remote attack path based on the supplied evidence.
Researcher notes
The strongest evidence is the kernel commit narrative and test output showing missed KASAN detection before the fix. The bundle does not establish exploitability beyond the CVSS vector. Validate affectedness through kernel config, architecture, and downstream patch status before escalating incident response.
Mitigation direction
- Update affected Linux kernels using vendor or upstream stable guidance.
- Prioritize PowerPC systems and kernels built with relevant KASAN configuration.
- Review referenced stable kernel commits for the specific fix lineage.
- Use distribution advisories to confirm fixed package versions.
- Do not rely on upstream version strings without checking backports.
Validation and detection
- Inventory Linux kernel versions and architecture across managed systems.
- Identify PowerPC hosts and KASAN-enabled kernel builds.
- Compare running kernels against vendor advisories and fixed stable commits.
- Confirm test or staging kernels include the referenced KASAN fix.
- Document exceptions where no affected configuration is present.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47640 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7f19245c3647afea8c7c41f795506ef70f64b9f2CVE reference, Linux
- https://git.kernel.org/stable/c/f39a3309393a4a484532f6ba745c6acbcfe06115CVE reference, Linux
- https://git.kernel.org/stable/c/5a3d8f3192a409893c57808cc935e16484df1068CVE reference, Linux
- https://git.kernel.org/stable/c/de56beace6648065d404cd9835aa7d30e3df519dCVE reference, Linux
- https://git.kernel.org/stable/c/e3d157a4b4f4e0268c98be5b7013bf4b31234bb6CVE reference, Linux
- https://git.kernel.org/stable/c/dd75080aa8409ce10d50fb58981c6b59bf8707d3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.