CVE-2021-46970

What it actually does

Incorrectly marking a dedicated high-priority workqueue for MHI state changes with the WQ_MEM_RECLAIM flag, allowing non-reclaim work (that performs blocking memory allocations for device creation and firmware loading) to be flushed from reclaim paths and triggering check_flush_dependency warnings.

Why it matters to the business

Kernel warnings and potential reliability issues on systems with MHI PCI devices such as certain modems or network hardware, leading to degraded operational stability without direct data loss.

How an attack unfolds

An attacker with local access triggers device removal or driver unload sequences that cause the state-change worker to flush non-reclaim workqueues, surfacing warnings and possible forward-progress problems under memory pressure; no remote exploitation or privilege escalation path exists.

How to fix it

Update the Linux kernel to a version containing the fix that removes the WQ_MEM_RECLAIM flag from the state workqueue; apply the change in mhi_pci_generic.c and rebuild or install the corrected kernel package.

How to confirm the fix worked

Boot the updated kernel and confirm absence of the check_flush_dependency warning containing mhi_pm_st_worker and events_highpri when performing MHI device attach/detach operations.

Typical attack path

1. Obtain local access on a Linux system using MHI PCI hardware
2. Trigger mhi_driver_remove or net device unregister paths
3. Invoke mhi_pm_st_worker flush that hits the reclaim dependency check

How to detect it

Search kernel logs and dmesg output for workqueue warnings referencing mhi_hiprio_wq, mhi_pm_st_worker, and check_flush_dependency during device removal or driver unload events.

• workqueue: WQ_MEM_RECLAIM mhi_hiprio_wq:mhi_pm_st_worker [mhi] is flushing !WQ_MEM_RECLAIM
• WARNING: CPU:.*PID:.*at kernel/workqueue.c.*check_flush_dependency
• mhi_pm_st_worker+0x921/0xf50 [mhi]

What your security team should do

• Prioritize kernel updates on systems exposing MHI devices
• Add monitoring for workqueue flush warnings in production kernels
• Test device removal paths in staging environments after patching