Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Linux Linux — NFSD: Fix READDIR buffer overflow
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U H H H 7.8 .0085 55.2 —
AFFECTED
Product Versions Fixed
Linux 37aa5e64022243e721b8334122997881177a4cfc – —
Linux 5.13 – 5.15.12
TIMELINE
Mar 4 Reserved by Linux
Mar 4 Published (CNA: Linux)
Aug 4 EXPLOIT PUBLISHED — CVE-2021-47107 (Linux). Public exploit reference added.
Aug 4 RESCORED — CVE-2021-47107 (Linux). CVSS 9.8 → 7.8 (NVD).
Description
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix READDIR buffer overflow
If a client sends a READDIR count argument that is too small (say,
zero), then the buffer size calculation in the new init_dirlist
helper functions results in an underflow, allowing the XDR stream
functions to write beyond the actual buffer.
This calculation has always been suspect. NFSD has never sanity-
checked the READDIR count argument, but the old entry encoders
managed the problem correctly.
With the commits below, entry encoding changed, exposing the
underflow to the pointer arithmetic in xdr_reserve_space().
Modern NFS clients attempt to retrieve as much data as possible
for each READDIR request. Also, we have no unit tests that
exercise the behavior of READDIR at the lower bound of @count
values. Thus this case was missed during testing.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| March 4, 2024 | Reserved | Reserved by Linux |
| March 4, 2024 | Published | Published (CNA: Linux) |
| August 4, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2021-47107 (Linux). Public exploit reference added. |
| August 4, 2026 | RESCORED | RESCORED — CVE-2021-47107 (Linux). CVSS 9.8 → 7.8 (NVD). |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | 37aa5e64022243e721b8334122997881177a4cfc | — |
| Linux | Linux | — | 5.13 | 5.15.12 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-47107 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.