Security readout for executives and security teams
Plain-English summary
CVE-2021-47652 is a Linux kernel crash issue in the smscufx framebuffer driver. If a specific allocation fails during USB device probing, cleanup can dereference an uninitialized list and crash the kernel. The main business impact is local denial of service, not data theft or remote compromise based on the provided sources.
Executive priority
Treat this as a moderate availability risk. It is not evidenced as remotely exploitable or actively abused, but affected multi-user Linux systems should be patched through normal kernel maintenance because a local crash can disrupt business services.
Technical view
The flaw is a CWE-476 null pointer dereference in ufx_usb_probe(). When fb_alloc_cmap() fails, the error path calls fb_destroy_modelist() before modelist is initialized. The fix initializes modelist before fb_alloc_cmap(). CVSS 3.1 is 5.5: local access, low complexity, low privileges, no user interaction, high availability impact.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the smscufx driver present or usable. The provided data lists Linux kernels including 3.2, 4.9.311, 4.14.276, 4.19.238, 5.4.189, 5.10.110, 5.15.33, 5.16.19, 5.17.2, and 5.18 as affected.
Exploitation context
The source bundle does not show active exploitation, and KEV status is false. The CVSS vector indicates local, low-privilege exploitation with availability impact only. No evidence in the provided sources supports remote exploitation, privilege escalation, data disclosure, or integrity impact.
Researcher notes
Focus review on smscufx probe error handling and vendor backports of the modelist initialization fix. Evidence is limited to the CVE record, CVSS vector, affected version data, and upstream stable commits; the bundle does not include exploit proof or operational telemetry.
Mitigation direction
- Update to a vendor kernel containing the upstream smscufx ufx_usb_probe fix.
- Check distribution advisories for backported fixes before relying on version numbers alone.
- Prioritize systems where untrusted local users can access affected Linux hosts.
- If smscufx is unnecessary, follow vendor guidance to reduce driver availability.
Validation and detection
- Inventory Linux kernel versions across servers, endpoints, and appliances.
- Check whether the smscufx driver is built, packaged, loaded, or available.
- Confirm vendor kernel changelogs include the referenced upstream fix.
- Retest after patching to verify the remediated kernel is running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47652 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d1b6a1f0c23b7164250479bf92e2893291dca539CVE reference, Linux
- https://git.kernel.org/stable/c/0fd28daec73525382e5c992db8743bf76e42cd5cCVE reference, Linux
- https://git.kernel.org/stable/c/dd3a6cc7385b89ec2303f39dfc3bafa4e24cec4bCVE reference, Linux
- https://git.kernel.org/stable/c/da8b269cc0a2526ebeaccbe2484c999eb0f822cfCVE reference, Linux
- https://git.kernel.org/stable/c/64ec3e678d76419f207b9cdd338dda438ca10b1cCVE reference, Linux
- https://git.kernel.org/stable/c/c420b540db4b5d69de0a36d8b9d9a6a79a04f05aCVE reference, Linux
- https://git.kernel.org/stable/c/d396c651e2b508b6179bb678cc029f3becbf5170CVE reference, Linux
- https://git.kernel.org/stable/c/9280ef235b05e8f19f8bc6d547b992f0a0ef398dCVE reference, Linux
- https://git.kernel.org/stable/c/1791f487f877a9e83d81c8677bd3e7b259e7cb27CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.