Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory safety bug in the JFFS2 filesystem. A local user who can trigger mounting of a malformed JFFS2 image could cause use-after-free behavior in kernel code, with potential confidentiality, integrity, and availability impact.
Executive priority
Treat as high priority for embedded Linux, appliance, and flash-filesystem environments. For standard servers without JFFS2 use or untrusted mount paths, urgency is lower but patching should follow normal kernel maintenance windows.
Technical view
During JFFS2 mount error handling, jffs2_clear_xattr_subsystem() can be called twice after jffs2_scan_eraseblock() fails, freeing xattr references and then reading freed memory. The published fix changes the cleanup path so the xattr subsystem is not cleared again.
Likely exposure
Most relevant to Linux systems that support or use JFFS2, especially embedded, appliance, flash-storage, or MTD-based environments. General-purpose servers are less likely exposed unless JFFS2 support is enabled and untrusted local users can influence mounts.
Exploitation context
The CVSS vector is local, low complexity, low privileges, and no user interaction. The source bundle does not show CISA KEV listing or evidence of active exploitation. Exploitation would require local conditions involving a malformed JFFS2 image and mount path access.
Researcher notes
Evidence supports a JFFS2 mount-time use-after-free tied to duplicated cleanup after jffs2_build_filesystem() errors. The bundle provides kernel fix commits and CVSS data, but no public exploit confirmation, distro-specific affected package matrix, or operational workaround beyond applying fixed kernels and reducing mount exposure.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable JFFS2 fix.
- Check Linux distribution or appliance vendor advisories for backported patches.
- Restrict mounting of untrusted filesystem images to trusted administrators.
- Disable or remove JFFS2 support where it is unnecessary.
- Prioritize embedded and MTD-backed systems during remediation planning.
Validation and detection
- Inventory kernel versions across Linux and embedded fleets.
- Confirm whether JFFS2 support is built, loaded, or used.
- Compare deployed kernels against vendor advisories and referenced stable commits.
- Review local mount permissions and image ingestion workflows.
- Test kernel updates in staging before production rollout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47656 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9CVE reference, Linux
- https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5CVE reference, Linux
- https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101CVE reference, Linux
- https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422CVE reference, Linux
- https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13CVE reference, Linux
- https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1CVE reference, Linux
- https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44CVE reference, Linux
- https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afedCVE reference, Linux
- https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.