Answer in brief
CVE-2021-47316 records a High severity (CVSS 7.5) vulnerability in nfsd: fix NULL dereference in nfs3svc_encode_getaclres. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d505e66191072748620fc0af038cea4e4da0e3cd <e79057d15d96ef19de4de6d7e479bae3d58a2a8d || >=20798dfe249a01ad1b12eec7dbc572db5003244a <650e6f383a6eb40f7c0a010982a74ab4b6893870 || >=20798dfe249a01ad1b12eec7dbc572db5003244a <ab1016d39cc052064e32f25ad18ef8767a0ee3b8 | e79057d15d96ef19de4de6d7e479bae3d58a2a8d, 650e6f383a6eb40f7c0a010982a74ab4b6893870, ab1016d39cc052064e32f25ad18ef8767a0ee3b8 |
| Linux/Linuxgeneric | 5.13 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <V1.1.1 | V1.1.1 |
Published upstream
May 21, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix NULL dereference in nfs3svc_encode_getaclres In error cases the dentry may be NULL. Before 20798dfe249a, the encoder also checked dentry and d_really_is_positive(dentry), but that looks like overkill to me--zero status should be enough to guarantee a positive dentry. This isn't the first time we've seen an error-case NULL dereference hidden in the initialization of a local variable in an xdr encoder. But I went back through the other recent rewrites and didn't spot any similar bugs.
Quoted source text, attributed separately from HOL analysis.