Security readout for executives and security teams
Plain-English summary
CVE-2021-47648 is a Linux kernel memory leak in the GPU host1x removal path. A missing cleanup call can leave allocated channel-list memory behind. The rated impact is availability, not data theft or tampering. It requires local low-privileged access, so urgency is highest for multi-user or shared Linux systems using affected kernels.
Executive priority
Treat as a normal kernel maintenance item, not an emergency. Patch through standard kernel update cycles, with higher priority for shared Linux systems where local users can run code.
Technical view
The Linux kernel host1x driver omitted host1x_channel_list_free() in host1x_remove(), although the probe error path already performed that cleanup. The issue is classified as CWE-401 and CVSS 3.1 5.5 with local attack vector, low complexity, low privileges, no user interaction, and high availability impact.
Likely exposure
Exposure is limited to Linux systems running affected kernel builds with the gpu/host1x code present and relevant hardware or driver use. The source data names Linux as affected and references stable kernel fixes, but distribution backport status must be checked separately.
Exploitation context
The provided sources do not show active exploitation, and KEV is false. The CVSS vector indicates local low-privileged access is required. No cited source provides public exploit evidence, exploit maturity, or remote attack capability.
Researcher notes
Evidence supports a memory leak in the host1x device removal path fixed by adding missing cleanup. The bundle does not include exploit details, distro package mappings, or proof of practical denial-of-service conditions, so validation should focus on kernel lineage and vendor backports.
Mitigation direction
- Update to a kernel containing the referenced stable fixes or a vendor-backported equivalent.
- Check Linux distribution advisories for the exact patched package version.
- Prioritize shared, multi-user, or appliance-like systems where local users are less trusted.
- If immediate patching is delayed, reduce untrusted local access where operationally feasible.
Validation and detection
- Inventory kernel versions and compare them with vendor fixed package guidance.
- Confirm whether the host1x driver is built, loaded, or relevant on the asset.
- Review kernel package changelogs for the referenced host1x_remove cleanup fix.
- Track this CVE in vulnerability management until vendor status is confirmed.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 6bb107332db28a0e9256c2d36a0902b85307612c
- Linux stable commit c06577a80485511b894cb688e881ef0bc2d1d296
- Linux stable commit 5124a344983e1b9670dae7add0e4d00d589aabcd
- Linux stable commit fe1ce680560d4f0049ffa0c687de17567421c1ec
- Linux stable commit 025c6643a81564f066d8381b9e2f4603e0f8438f
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47648 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6bb107332db28a0e9256c2d36a0902b85307612cCVE reference, Linux
- https://git.kernel.org/stable/c/c06577a80485511b894cb688e881ef0bc2d1d296CVE reference, Linux
- https://git.kernel.org/stable/c/5124a344983e1b9670dae7add0e4d00d589aabcdCVE reference, Linux
- https://git.kernel.org/stable/c/fe1ce680560d4f0049ffa0c687de17567421c1ecCVE reference, Linux
- https://git.kernel.org/stable/c/025c6643a81564f066d8381b9e2f4603e0f8438fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.