CVE-2021-47202

mediumcovered by 4 sourcesfirst seen 2026-07-10

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284) It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - InfiniBand drivers; - SCSI subsystem; - Thermal drivers; - USB over IP driver; - Network file system (NFS) server daemon; - SMB network file system; - Tracing infrastructure; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Ceph Core library; - DCCP (Datagram Congestion Control Protocol); - IPv4 networking; - IPv6 networking; - Netfilter; - RxRPC session sockets; - X.25 network layer; (CVE-2021-47202, CVE-2024-56643, CVE-2026-23272, CVE-2026-23455, CVE-2026-31402, CVE-2026-31607, CVE-2026-31637, CVE-2026-31659, CVE-2026-31682, CVE-2026-31685, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43383, CVE-2026-43407, CVE-2026-43414, CVE-2026-45988, CVE-2026-46043, CVE-2026-46119, CVE-2026-46243)

CSIRTS triage

What: Multiple vulnerabilities in the Linux kernel could allow local attackers to escalate privileges or escape containers.
Who is affected: Local attackers on systems running the affected Linux kernel.
Urgency: Remediation is urgent due to the potential for privilege escalation and confirmed exploitation status.
Action: Apply the latest security updates for the Linux kernel.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2021-47202

Get an email if CVE-2021-47202 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.

Advisory coverage (4)

medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilitiescert-bund · 2026-07-10
unknownUSN-8530-1: Linux kernel (AWS) vulnerabilitiesubuntu · 2026-07-10
unknownUSN-8529-1: Linux kernel vulnerabilitiesubuntu · 2026-07-10
unknownMultiple vulnerabilities in Ubuntu Linux kernel (July 10, 2026)cert-fr-avis · 2026-07-10

External references

NVD record for CVE-2021-47202

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2021-47202 status](https://www.csirts.com/badge/CVE-2021-47202)](https://www.csirts.com/cve/CVE-2021-47202)