CVE-2021-46988

What it actually does

A failure to release an allocated page in an error path within shmem_mfill_atomic_pte can trigger a BUG_ON assertion in the caller when a subsequent accounting failure occurs, leading to a kernel crash.

Why it matters to the business

Systems may experience unexpected crashes or instability when specific memory management operations involving userfaultfd and tmpfs are performed under error conditions, potentially disrupting services and requiring reboots.

How an attack unfolds

An attacker with local access crafts a sequence of userfaultfd ioctls that cause copy_from_user failures followed by accounting failures in tmpfs, leading to the unhandled page and kernel BUG.

How to fix it

Update the Linux kernel to a version containing the fix that releases any dangling page when accounting fails inside shmem_mfill_atomic_pte.

How to confirm the fix worked

Confirm the patch is present by inspecting the shmem.c source for the dangling-page release logic or by exercising the documented error sequence without triggering BUG_ON.

Typical attack path

1. Obtain local unprivileged access to a Linux system
2. Issue UFFD ioctls that reach shmem_mfill_atomic_pte and succeed in page allocation
3. Force a copy_from_user failure returning -ENOENT
4. Trigger a subsequent shmem accounting failure before the page is consumed

How to detect it

Inspect kernel logs (dmesg, syslog) for BUG_ON assertions referencing page consumption or userfaultfd shmem paths after error returns from mfill_atomic.

What your security team should do

• Prioritize kernel updates on all affected Linux distributions
• Reboot systems after applying updates to load the fixed kernel
• Review local user access controls to reduce exposure to the triggering code path