Security readout for executives and security teams
Plain-English summary
CVE-2021-47646 is a Linux kernel use-after-free issue in block/BFQ behavior. The CVSS vector requires local access with low privileges, but impact is rated high for confidentiality, integrity, and availability. Treat exposed multi-user Linux systems and hosts running affected kernel lines as priority patch candidates.
Executive priority
High. This is not described as remotely exploitable, but successful local exploitation could have full system impact. Patch during the next urgent kernel maintenance window, with faster action for systems where untrusted users or workloads can execute locally.
Technical view
The source describes a crash tied to BFQ queue merge handling. The triggering commit was not the root cause; it exposed a use-after-free that was fixed separately, and this CVE restores the queue-merge behavior after that fix. Evidence names CWE-416 and Linux stable commits as references.
Likely exposure
Exposure is likely on Linux systems running affected kernel versions or vendor kernels that include the vulnerable BFQ/block code. The record lists affected Linux kernel lines including 4.12, 4.19.238, 5.4.189, 5.10.110, 5.15.33, 5.16.19, 5.17.2, and 5.18.
Exploitation context
The provided CVSS vector is local, low complexity, low privilege, and no user interaction. The bundle does not show CISA KEV listing or other evidence of active exploitation, so active exploitation should not be claimed from these sources.
Researcher notes
The record is unusual because the named change restores a reverted commit after a separate UAF fix. Validate against exact stable or distribution backports rather than relying only on upstream version numbers. Evidence in the bundle is incomplete on exploitability details beyond CVSS.
Mitigation direction
- Apply vendor or Linux stable kernel updates containing the referenced fixes.
- Prioritize patching shared, multi-user, container-host, and workstation Linux systems.
- Check distribution advisories for exact fixed package versions.
- If patching is delayed, reduce local shell access to affected systems.
- Track kernel provenance for appliances using vendor-supplied Linux kernels.
Validation and detection
- Inventory Linux kernel versions across servers, workstations, and appliances.
- Compare running kernels with vendor advisories and the CVE affected record.
- Confirm updated kernels are booted, not only installed.
- Review whether BFQ/block scheduler code is present in vendor kernel builds.
- Document exceptions where vendor guidance is unavailable or incomplete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47646 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f990f0985eda59d4f29fc83fcf300c92b1225d39CVE reference, Linux
- https://git.kernel.org/stable/c/931aff627469a75c77b9fd3823146d0575afffd6CVE reference, Linux
- https://git.kernel.org/stable/c/cc051f497eac9d8a0d816cd4bffa3415f2724871CVE reference, Linux
- https://git.kernel.org/stable/c/65d8a737452e88f251fe5d925371de6d606df613CVE reference, Linux
- https://git.kernel.org/stable/c/abc2129e646af7b43025d90a071f83043f1ae76cCVE reference, Linux
- https://git.kernel.org/stable/c/4083925bd6dc89216d156474a8076feec904e607CVE reference, Linux
- https://git.kernel.org/stable/c/15729ff8143f8135b03988a100a19e66d7cb7ecdCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.