PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-47316 Linux CVE debrief

CVE-2021-47316 is a Linux kernel nfsd NULL dereference issue in the nfs3svc_encode_getaclres XDR encoder. The NVD record lists Linux kernel versions 5.13 through before 5.13.4 as affected. The supplied description says that in error cases the dentry may be NULL, and that the encoder previously performed extra checks before later simplification. The published CVSS vector indicates a local, low-privilege path with no user interaction and high availability impact.

Vendor
Linux
Product
CVE-2021-47316
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-21
Original CVE updated
2026-05-12
Advisory published
2024-05-21
Advisory updated
2026-05-12

Who should care

Administrators and platform teams running affected Linux kernel releases, especially systems that use the NFS server stack (nfsd) in production or multi-user environments where a kernel crash would affect availability.

Technical summary

The flaw is a NULL pointer dereference in the Linux kernel nfsd function nfs3svc_encode_getaclres. According to the CVE description, error cases can leave the dentry pointer NULL, creating a crash-prone code path during ACL response encoding. NVD classifies the weakness as CWE-476 and assigns CVSS 3.1 5.5/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, which points to local exploitation conditions and primary availability impact.

Defensive priority

Medium. Treat as higher priority on systems that expose or depend on NFS server functionality and where a kernel crash would be operationally significant.

Recommended defensive actions

  • Apply the Linux kernel updates that include the referenced fix commits from the official kernel.org patch links.
  • Verify whether any deployed kernels fall within the NVD-identified affected range of 5.13 through before 5.13.4.
  • If immediate patching is not possible, reduce operational exposure of NFS server functionality where feasible and acceptable.
  • Use your distribution or vendor advisories to confirm whether backported fixes are already present in packaged kernels.
  • Monitor affected hosts for kernel instability or crashes associated with NFS server activity until remediation is complete.

Evidence notes

This debrief is based on the supplied NVD CVE record and official references. The record was published on 2024-05-21 and modified on 2026-05-12. NVD lists CWE-476, CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, and affected Linux kernel versions 5.13 through before 5.13.4. The CVE description identifies the bug as a NULL dereference in nfs3svc_encode_getaclres when dentry may be NULL in error cases. The referenced kernel.org links are patch references associated with the fix.

Official resources

Public vulnerability record published by NVD on 2024-05-21 and modified on 2026-05-12. The provided sources do not include a separate exploit disclosure date.