CVE-2021-47002 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, and operators of systems running affected kernel versions should care, especially where SUNRPC/SVC request handling is present. Because the issue is local and can impact availability, it is most relevant for environments that prioritize kernel stability and service uptime.

Technical summary

The flaw is a CWE-476 null pointer dereference in the SUNRPC service request lifecycle. NVD describes affected Linux kernel ranges as versions before 5.10.221, 5.11.22, and 5.12.5. The kernel fix adds a null check so svc_rqst_free() does not call put_page() on a null rq_scratch_page when memory allocation fails earlier in svc_rqst_alloc().

Defensive priority

Medium priority. The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, which indicates a local attack surface with high availability impact. Patch or backport the kernel fix if you run an affected release.

Recommended defensive actions

• Confirm whether your Linux kernel version falls within the vulnerable ranges listed by NVD: before 5.10.221, 5.11.22, or 5.12.5.
• Apply the upstream or vendor kernel patch that adds the null check in svc_rqst_free().
• If immediate patching is not possible, prioritize kernel updates on systems where local users are present or where service availability is critical.
• Validate any vendor backport by checking that the SUNRPC fix is included in your distribution’s kernel changelog or security advisory.
• Monitor for kernel crashes or oops events involving SUNRPC service request paths, as the issue affects availability.

Evidence notes

Supported by the CVE description, NVD CVSS/CWE data, and kernel patch references. The CVE record states that alloc_pages_node() may return null in svc_rqst_alloc(), leading to a null rq_scratch_page dereference in svc_rqst_free(); the fix is to add a null check. NVD lists affected Linux kernel version ranges and classifies the weakness as CWE-476.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.