Security readout for executives and security teams
Plain-English summary
CVE-2021-47651 is a Linux kernel availability flaw in Qualcomm power-domain code. If memory allocation fails, the driver may dereference a null pointer and crash the kernel. The published impact is denial of service only, with local low-privileged access required.
Executive priority
Treat as a moderate patch-management item. It can crash affected systems, but the sources show local access requirements, no confidentiality impact, and no confirmed active exploitation. Prioritize exposed Qualcomm-based Linux devices according to uptime criticality.
Technical view
The Qualcomm rpmpd driver did not check whether devm_kcalloc returned NULL before later dereferencing data->domains. The kernel fix adds an allocation-failure check and returns -ENOMEM. CVSS 3.1 is 5.5: local, low complexity, low privileges, no user interaction, high availability impact.
Likely exposure
Exposure is most likely on Linux systems using affected kernel versions and the Qualcomm rpmpd driver path, typically Qualcomm-based platforms. The source bundle lists Linux as affected but does not provide distribution package names, device models, or confirmed deployment prevalence.
Exploitation context
CISA KEV status is false in the source bundle, and no cited source states active exploitation. The CVSS vector indicates local low-privileged access is required. The practical result is kernel crash or denial of service, not data theft or integrity compromise.
Researcher notes
Evidence supports CWE-476 null pointer dereference caused by unchecked devm_kcalloc failure in soc/qcom/rpmpd. The bundle’s affected-version data is limited and includes commit references, so validate against downstream vendor kernels before scoping production exposure.
Mitigation direction
- Update to a Linux kernel containing the referenced stable fixes.
- Check vendor or distribution advisories for package-specific fixed versions.
- Prioritize Qualcomm-based systems where rpmpd support is enabled.
- Schedule reboot or maintenance as required for kernel replacement.
Validation and detection
- Inventory running kernel versions across affected Linux assets.
- Confirm whether Qualcomm rpmpd driver support is built or loaded.
- Compare kernel source or packages against the referenced stable commits.
- Review crash logs for rpmpd-related null pointer dereference symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47651 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/755dbc3d73789ac9f0017c729abf5e4b153bf799CVE reference, Linux
- https://git.kernel.org/stable/c/b5d6eba71997b6d661935d2b15094ac7f9f6132dCVE reference, Linux
- https://git.kernel.org/stable/c/724376c30af5a57686b223dbcd6188e07d2a1de2CVE reference, Linux
- https://git.kernel.org/stable/c/84b89fa877ad576e9ee8130f412cfd592f274508CVE reference, Linux
- https://git.kernel.org/stable/c/31b5124d742969ea8bf7a1360596f548ca23e770CVE reference, Linux
- https://git.kernel.org/stable/c/5a811126d38f9767a20cc271b34db7c8efc5a46cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.