CVE-2021-47117

mediumcovered by 3 sourcesfirst seen 2026-07-15

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SCSI subsystem; - Thermal drivers; - USB over IP driver; - File systems infrastructure; - Ext4 file system; - Network file system (NFS) server daemon; - SMB network file system; - Tracing infrastructure; - B.A.T.M.A.N. meshing protocol; - Ceph Core library; - DCCP (Datagram Congestion Control Protocol); - IPv4 networking; - IPv6 networking; - Netfilter; - RxRPC session sockets; - X.25 network layer; (CVE-2021-47117, CVE-2021-47202, CVE-2023-52646, CVE-2024-56643, CVE-2026-23455, CVE-2026-31402, CVE-2026-31607, CVE-2026-31637, CVE-2026-31659, CVE-2026-31685, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43383, CVE-2026-43407, CVE-2026-43414, CVE-2026-45988, CVE-2026-46119, CVE-2026-46243)

CSIRTS triage

What: A logic flaw in the XFRM ESP-in-TCP subsystem could allow local privilege escalation.
Who is affected: All deployments using the affected Linux kernel versions.
Urgency: Remediation is urgent due to the potential for local privilege escalation and system compromise.
Action: Apply the latest security updates for the Linux kernel.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2021-47117

Get an email if CVE-2021-47117 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.

Advisory coverage (3)

unknownMultiple vulnerabilities in the Ubuntu Linux kernel (July 17, 2026)cert-fr-avis · 2026-07-17
medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow Denial of Servicecert-bund · 2026-07-16
unknownUSN-8548-1: Linux kernel vulnerabilitiesubuntu · 2026-07-15

External references

NVD record for CVE-2021-47117

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2021-47117 status](https://www.csirts.com/badge/CVE-2021-47117)](https://www.csirts.com/cve/CVE-2021-47117)