CVE-2021-46953

What it actually does

The ACPI GTDT driver unmaps an interrupt without verifying successful prior mapping, allowing firmware-supplied illegal interrupt numbers that overlap the GIC SGI range to unmap an IPI and trigger kernel instability or arbitrary code execution.

Why it matters to the business

Local attackers with administrative access can crash systems or execute code in the kernel, leading to downtime, data corruption, or full host compromise on Linux servers and embedded devices; widespread kernel prevalence increases blast radius.

How an attack unfolds

An attacker supplies malicious ACPI tables or firmware properties that cause the GTDT driver probe to fail after an interrupt mapping attempt; the missing success check then unmaps a GIC SGI IPI, resulting in subsequent kernel fireworks that an attacker can weaponize for privilege escalation or denial of service.

How to fix it

Upgrade to a Linux kernel containing the fix that validates interrupt mapping success before any unmap operation; apply the latest stable kernel package for the distribution and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel version contains the GTDT probe-failure mapping check; inspect dmesg or kernel logs for absence of spurious IPI unmap warnings during ACPI GTDT initialization; run vendor-supplied kernel regression tests exercising GTDT probe paths.

Typical attack path

1. Obtain local administrative access on a Linux system
2. Provide crafted ACPI GTDT firmware data triggering invalid interrupt properties
3. Force GTDT driver probe failure path
4. Trigger unmapping of overlapping GIC SGI IPI
5. Exploit resulting kernel state for code execution or crash

How to detect it

Review kernel logs for GTDT probe failure messages followed by unexpected IPI or interrupt-related warnings; correlate with ACPI table load events; look for post-boot crashes or watchdog resets on systems exposing GTDT.

What your security team should do

• Prioritize kernel updates on all Linux hosts within the next maintenance window
• Monitor vendor advisories for backported fixes in LTS kernels
• Restrict local administrative access and firmware update privileges until patched
• Include GTDT-related kernel messages in SIEM alerting rules