Security readout for executives and security teams
Plain-English summary
CVE-2021-47641 is a Linux kernel crash bug in the cirrusfb framebuffer driver. A local low-privileged user may trigger a divide-by-zero condition by reaching the affected framebuffer ioctl path, causing a denial of service. It does not indicate data theft or privilege escalation in the supplied sources.
Executive priority
Treat this as a moderate availability risk, not a breach indicator. Patch through normal kernel maintenance, with earlier attention for shared Linux hosts, virtualized environments, or systems where untrusted local users exist.
Technical view
The cirrusfb driver failed to sanity-check a zero pixclock value before calculating derived frequency, leading to CWE-369 divide-by-zero in cirrusfb_check_var via fb_set_var and fb_ioctl. The fix adds pixclock validation and rounding behavior. CVSS is 5.5: local, low complexity, low privilege, no user interaction, availability impact only.
Likely exposure
Exposure is most likely on Linux systems running affected kernels with the cirrusfb framebuffer driver reachable locally. This is not described as remotely exploitable. Systems without the affected driver path exposed are less likely to be practically exposed, but source data does not provide a full product matrix.
Exploitation context
The source describes a Syzkaller-triggered kernel divide error on Linux 5.15.0-rc6 under QEMU. The record is not in KEV, and the provided sources do not claim active exploitation in the wild or public weaponization.
Researcher notes
The evidence supports local denial of service through framebuffer ioctl handling. The affected data lists Linux versions and stable commits, but does not name distributions, package versions, exploit availability, or non-Linux products. Avoid broad claims beyond kernels carrying the vulnerable cirrusfb code.
Mitigation direction
- Apply kernel updates containing the referenced stable cirrusfb pixclock sanity-check fixes.
- Confirm your distribution has backported the fix into its supported kernel package.
- Prioritize systems where local users can access framebuffer devices.
- If patch status is unclear, follow Linux distribution or vendor kernel guidance.
Validation and detection
- Inventory Linux kernel versions against the affected version data in the CVE record.
- Check whether cirrusfb framebuffer support is present and reachable on relevant systems.
- Review vendor kernel changelogs for the referenced stable commit IDs or equivalent backports.
- Look for historical kernel oops reports matching cirrusfb_check_var or fb_ioctl divide errors.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-369: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47641 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c656d04247a2654ede5cead2ecbf83431dad5261CVE reference, Linux
- https://git.kernel.org/stable/c/1d3fb46439ad4e8f0c5739eb33d1875ac9e0f135CVE reference, Linux
- https://git.kernel.org/stable/c/40b13e3d85744210db13457785646634e2d056bdCVE reference, Linux
- https://git.kernel.org/stable/c/53a2088a396cfa1da92690a1da289634cd73bf0dCVE reference, Linux
- https://git.kernel.org/stable/c/8c7e2141fb89c620ab4e41512e262fbf25b8260dCVE reference, Linux
- https://git.kernel.org/stable/c/6fe23ff94e7840097202e85c148688940b37c9b1CVE reference, Linux
- https://git.kernel.org/stable/c/45800c42ef000f417270bcfc08630e42486fca99CVE reference, Linux
- https://git.kernel.org/stable/c/e498b504f8c81b07efab9febf8503448de4dc9cfCVE reference, Linux
- https://git.kernel.org/stable/c/5c6f402bdcf9e7239c6bc7087eda71ac99b31379CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Divide By Zero
Divide By Zero represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.