CVE-2021-46984

What it actually does

Race condition between two blk_mq_get_ctx calls allows kyber_bio_merge to obtain a ctx whose index_hw exceeds the nr_ctx of the supplied hctx, producing an out-of-bounds read inside queued_spin_lock_slowpath.

Why it matters to the business

Systems using the kyber I/O scheduler can suffer kernel crashes or undefined behavior during write-heavy workloads, causing service outages and unplanned reboots on storage-intensive servers.

How an attack unfolds

An attacker submits concurrent block I/O that forces preemption between the first and second ctx acquisition; the resulting ctx/hctx mismatch triggers the out-of-bounds access during spinlock acquisition inside kyber_bio_merge.

How to fix it

Upgrade to a Linux kernel that contains the fix which passes the request_queue instead of an hctx to bio_merge, eliminating the ctx/hctx mismatch for kyber.

How to confirm the fix worked

Confirm the running kernel contains the commit titled "kyber: fix out of bounds access when preempted"; reproduce the original workload under forced preemption and verify absence of the UBSAN report.

Typical attack path

1. Issue high-rate write I/O from user space or via a filesystem such as btrfs
2. Force scheduler preemption between the two blk_mq_get_ctx calls
3. Trigger kyber_bio_merge with mismatched ctx and hctx
4. Cause UBSAN-detected out-of-bounds access in the spinlock path

How to detect it

Search kernel logs and dmesg for UBSAN array-index-out-of-bounds reports that list kyber_bio_merge or queued_spin_lock_slowpath in the call trace; correlate with btrfs or other writeback activity.

• kyber_bio_merge+0x112/0x180
• UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c
• index .* is out of range for type 'long unsigned int [128]'
• do_raw_spin_lock.*kyber_bio_merge

What your security team should do

• Apply the upstream fix or distribution kernel update on all systems that enable the kyber scheduler
• Temporarily switch I/O scheduler to mq-deadline or none on high-risk hosts until patched
• Add kernel oops and UBSAN alerts mentioning kyber_bio_merge to SOC monitoring