# CVE-2021-47002: Linux Kernel null pointer dereference in SUNRPC svc_rqst_free

Source: https://junglewise.ai/threats/cve-2021-47002-linux-kernel-null-pointer-dereference-in-sunrpc-svc-rqst-free  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-02-28. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2021-47002 · Severity: medium · CVSS 5.5 · Published 2024-02-28

A vulnerability exists in the Linux kernel's SUNRPC component, which is used for network-based communication between systems. Under specific memory pressure conditions, the system may crash when attempting to free resources, leading to a denial-of-service. This affects various Linux-based systems, including industrial automation hardware like the Siemens SIMATIC S7-1500.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC S7-1500 TM MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-tm-mfp). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2021-47002 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-47002 being exploited in the wild.

**How severe is CVE-2021-47002?** Medium severity, with a CVSS score of 5.5, published 28 February 2024.

**Which products and versions are affected?** Linux Kernel up to 5.10.221, 5.11 to 5.11.22, 5.12 to 5.12.5; Siemens SIMATIC S7-1500 TM MFP All versions using affected Linux subsystem.

**Is there a fix for CVE-2021-47002?** A patch was published on 2021-04-23: Initial fix committed to Linux kernel mainline Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-47002 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2021-47002?** Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 TM MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference exists in the SUNRPC subsystem of the Linux kernel within the svc_rqst_free() function. The vulnerability occurs when alloc_pages_node() fails and returns NULL in svc_rqst_alloc(), leaving the rq_scratch_page pointer uninitialized. Subsequent calls to put_page() during the cleanup process in svc_rqst_free() do not verify if the pointer is NULL before dereferencing it. A local attacker can exploit this to trigger a kernel panic (denial-of-service). The issue has been resolved in various stable kernel branches (5.10.221, 5.11.22, 5.12.5) by adding a mandatory NULL check before the put_page() call.

## Affected products

- Linux Linux Kernel up to 5.10.221, 5.11 to 5.11.22, 5.12 to 5.12.5
- Siemens SIMATIC S7-1500 TM MFP All versions using affected Linux subsystem

## Timeline

- 2021-04-23: patched: Initial fix committed to Linux kernel mainline
- 2024-02-28: advisory: CVE published by kernel.org
- 2024-04-09: advisory: Siemens published advisory SSA-265688 covering affected industrial products

## References

- [https://git.kernel.org/stable/c/1e10f58f1c9a6b667b045513c7a4e6111c24fe7c](https://git.kernel.org/stable/c/1e10f58f1c9a6b667b045513c7a4e6111c24fe7c)
- [https://git.kernel.org/stable/c/3de81c1e84bf84803308da3272a829a7655c5336](https://git.kernel.org/stable/c/3de81c1e84bf84803308da3272a829a7655c5336)
- [https://git.kernel.org/stable/c/b9f83ffaa0c096b4c832a43964fe6bff3acffe10](https://git.kernel.org/stable/c/b9f83ffaa0c096b4c832a43964fe6bff3acffe10)
- [https://git.kernel.org/stable/c/c664aaec9aee544538a78ba4893a44bc73a6d742](https://git.kernel.org/stable/c/c664aaec9aee544538a78ba4893a44bc73a6d742)
- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)

## Related threats

- [Linux kernel xen-netback double unmap memory corruption](https://junglewise.ai/threats/cve-2026-99287-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel PMC uninitialized clock rate in 32-bit Tegra](https://junglewise.ai/threats/cve-2026-99259-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel x86 Hyper-V memory access violation](https://junglewise.ai/threats/cve-2026-99258-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel io_uring signal loss in worker exit](https://junglewise.ai/threats/cve-2026-99228-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel mv643xx_eth NULL pointer dereference in PHY probe](https://junglewise.ai/threats/cve-2026-99197-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)