CVE-2021-47259 – This Linux kernel vulnerability in the NFS clie... (How to Fix)

Q: What is the severity of CVE-2021-47259?

CVE-2021-47259 has a CVSS score of 7.5 (HIGH). This Linux kernel vulnerability in the NFS client allows a use-after-free condition when mounting multiple exports from the same server through different network interfaces. Attackers could potentially exploit this to crash the system or execute arbitrary code. Systems running affected Linux kernel versions with NFS client functionality are at risk.

📋 TL;DR

This Linux kernel vulnerability in the NFS client allows a use-after-free condition when mounting multiple exports from the same server through different network interfaces. Attackers could potentially exploit this to crash the system or execute arbitrary code. Systems running affected Linux kernel versions with NFS client functionality are at risk.

💻 Affected Systems

Products:

Linux kernel

Versions: Linux kernel versions 4.13 through 5.10 (specifically between 4.13 and somewhere between 5.7-5.10 where issue manifests)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when using NFS client to mount multiple exports from the same server through different network interfaces.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential arbitrary code execution with kernel privileges resulting in complete system compromise.

🟠

Likely Case

System crash or kernel panic causing denial of service, potentially requiring physical access or remote console to recover.

🟢

If Mitigated

Limited impact if NFS client functionality is disabled or if systems don't mount multiple exports from the same server via different NICs.

🌐 Internet-Facing: MEDIUM - Requires NFS client access to attacker-controlled servers, which is less common for internet-facing systems.

🏢 Internal Only: MEDIUM - Internal systems using NFS with multiple NICs to same server could be vulnerable to internal attackers.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires specific NFS mounting conditions and kernel memory manipulation expertise. No public exploits known.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in kernel versions with commits: 3e3c7ebbfac152d08be75c92802a64a1f6471a15, 42c10b0db064e45f5c5ae7019bbf2168ffab766c, 476bdb04c501fc64bf3b8464ffddefc8dbe01577, 72651c6579a25317a90536181d311c663d0329ab, c3b6cf64dfe4ef96e7341508d50d6998da7062c7

Vendor Advisory: https://git.kernel.org/stable/c/3e3c7ebbfac152d08be75c92802a64a1f6471a15

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable NFS client

linux

Prevent NFS client functionality if not required

modprobe -r nfs
echo 'blacklist nfs' >> /etc/modprobe.d/blacklist.conf

Avoid multiple NIC mounts

linux

Avoid mounting multiple exports from same server through different network interfaces

🧯 If You Can't Patch

Disable NFS client functionality if not required
Implement strict network segmentation to limit NFS access to trusted servers only

🔍 How to Verify

Check if Vulnerable:

Check kernel version and NFS usage: uname -r and examine /proc/mounts for NFS mounts

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and test NFS mounting scenarios that previously triggered the issue

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/messages or dmesg
NFS client crash logs
System crash/reboot events

Network Indicators:

Multiple NFS mount requests to same server from different source IPs

SIEM Query:

EventID=41 OR Source="kernel" AND Message="BUG: KASAN: use-after-free" OR "nfs4_init_client"

📊 Metadata

CVE ID: CVE-2021-47259

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: May 21, 2024

Last Updated: April 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47259, you might also want to check these: