CVE-2021-47427
CVE-2021-47427 is a critical use-after-free vulnerability in the Linux kernel's iSCSI subsystem (CVSS 9.8, CWE-416). It was resolved by a kernel patch (commit d39df158518c) that fixes the handling of iscsi_task during abort handling. No known exploitation or public exploit has been reported.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel (including version 5.15 as listed in CPE data).
Real-world impact
An attacker could potentially execute arbitrary code, cause denial of service, or escalate privileges by exploiting the use-after-free condition.
Why this severity
The CVSS v3.1 base score of 9.8 reflects a network‑reachable attack with low complexity, no privileges or user interaction required, and high impacts to confidentiality, integrity, and availability.
What to do about it
- 01Obtain the patch commit d39df158518c from the Linux kernel source.
- 02Apply the patch to the affected kernel version.
- 03Rebuild and reinstall the kernel.
- 04Reboot the system to load the patched kernel.
NVD-referenced vendor advisory
Timeline
- May 21, 2024 · May 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.