CVE-2021-46967

What it actually does

Missing VM_PFNMAP flag in vma->vm_flags for virtqueue doorbell mapping allows kernel panic when userspace attempts vhost IOTLB mapping of a register-backed doorbell lacking a backing page structure.

Why it matters to the business

Systems using vhost-vdpa in virtualized environments face unexpected kernel crashes that interrupt workloads and require reboots, though the low exploit probability limits widespread operational disruption.

How an attack unfolds

An attacker with access to trigger doorbell mapping through the vhost IOTLB path can cause the kernel to dereference an invalid page structure, resulting in a panic; no remote unauthenticated path or known threat actor campaigns are associated with this issue.

How to fix it

Apply the upstream kernel patch that sets the required vm_flags including VM_PFNMAP on the doorbell mapping; rebuild and deploy updated kernels containing the fix for vhost-vdpa.

How to confirm the fix worked

Confirm the presence of VM_PFNMAP in the vma flags for the doorbell VMA after applying the patch and test that IOTLB mapping attempts now return the expected bad-address error instead of panicking.

Typical attack path

1. Obtain local or guest access to a system with vhost-vdpa enabled
2. Configure or trigger virtqueue doorbell mapping via IOTLB
3. Force the kernel to treat the unmapped register region as a normal page-backed mapping
4. Trigger the resulting page structure dereference to induce panic

How to detect it

Review kernel logs for oops or panic entries mentioning vhost-vdpa, virtqueue, or doorbell mapping; inspect audit or system call traces showing IOTLB mapping attempts on affected kernels.

What your security team should do

• Prioritize kernel updates on hosts running vhost-vdpa workloads
• Monitor for kernel oops or panic logs referencing vhost-vdpa or virtqueue doorbell
• Restrict untrusted guest or user access to vhost IOTLB interfaces until patched