CVE-2021-47378

unknowncovered by 3 sourcesfirst seen 2026-08-12

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. (CVE-2025-27558) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - Cryptographic API; - GPU drivers; - InfiniBand drivers; - Media drivers; - NVIDIA Tegra memory controller driver; - Network drivers; - STMicroelectronics network drivers; - NVME drivers; - Ext4 file system; - IPv4 networking; - Network traffic control; - TCP network protocol; - Locking primitives; - B.A.T.M.A.N. meshing protocol; - Ceph Core library; - IPv6 networking; - Multipath TCP; - Netfilter; - SCTP protocol; - SMC sockets; (CVE-2021-47354, CVE-2021-47378, CVE-2024-38612, CVE-2026-31405, CVE-2026-31414, CVE-2026-31448, CVE-2026-31649, CVE-2026-31657, CVE-2026-31668, CVE-2026-43198, CVE-2026-43493, CVE-2026-43499, CVE-2026-46266, CVE-2026-46331, CVE-2026-52924, CVE-2026-52931, CVE-2026-52955, CVE-2026-52982, CVE-2026-52986, CVE-2026-53002, CVE-2026-53006, CVE-2026-53045, CVE-2026-53088, CVE-2026-53176, CVE-2026-53225, CVE-2026-53228, CVE-2026-53359)

CSIRTS triage

What: Multiple vulnerabilities in Linux kernel subsystems including improper handling of aggregated WiFi frames in mesh networks and flaws in cryptographic API, GPU, InfiniBand, network drivers, and file systems.
Who is affected: Systems running affected Linux kernel versions across multiple architectures.
Urgency: Moderate; multiple flaws across critical subsystems including networking but no public exploit reports; physical proximity required for WiFi injection attack.
Action: Apply USN-8633-2 kernel update when available from your distribution.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2021-47378

Get an email if CVE-2021-47378 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Moderate exploitation risk1.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 65% of all EPSS-scored CVEs.

Advisory coverage (3)

unknownUSN-8633-2: Linux kernel vulnerabilitiesubuntu · 2026-08-13
unknownUSN-8635-1: Linux kernel (Azure) vulnerabilitiesubuntu · 2026-08-12
unknownUSN-8633-1: Linux kernel vulnerabilitiesubuntu · 2026-08-12

External references

NVD record for CVE-2021-47378

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2021-47378 status](https://www.csirts.com/badge/CVE-2021-47378)](https://www.csirts.com/cve/CVE-2021-47378)