CVE-2021-46990

What it actually does

Race condition in powerpc/64s kernel entry flush mitigation toggling via debugfs allows partial patching of the fallback flush path while other CPUs remain active, resulting in corrupted link registers and control-flow corruption on return to userspace.

Why it matters to the business

Unexpected kernel-induced crashes on affected powerpc systems when security mitigations are enabled or disabled at runtime, leading to service interruptions and potential loss of availability on servers or embedded devices using this architecture.

How an attack unfolds

An attacker with write access to the entry_flush debugfs file triggers the mitigation toggle; the kernel begins live-patching the flush sequence without stopping other CPUs, so a concurrent thread executes the incompletely patched call site, returning to a corrupted address in kernel memory and crashing the process or system.

How to fix it

Apply the upstream fix that performs the entry_flush patching under stop_machine; rebuild and deploy the corrected kernel on all powerpc/64s systems; after upgrade, verify that toggling the debugfs file no longer produces crashes.

How to confirm the fix worked

Confirm the presence of the stop_machine wrapper around the entry flush patching code in the running kernel; attempt to toggle the entry_flush debugfs file under load and verify no segfaults or LR corruption occur.

Typical attack path

1. Obtain write access to /sys/kernel/debug/powerpc/entry_flush
2. Write a new value to toggle the mitigation
3. Kernel initiates self-patching without stop_machine on all CPUs
4. Another CPU executes the partially updated flush sequence
5. Link register is corrupted, causing segfault or kernel panic on userspace return

How to detect it

Search kernel and audit logs for segfaults where the instruction and link register both point into kernel text ranges; inspect debugfs access events around the time of the crash; look for powerpc entry_flush related messages in dmesg.

• segfault.*nip c000000000004c20
• entry_flush
• powerpc.*stop machine.*patching

What your security team should do

• Prioritize kernel upgrade on all powerpc/64s production systems
• Restrict debugfs access to root only via mount options or permissions
• Monitor kernel logs for LR corruption or entry flush related panics
• Test the toggle operation in a staging environment before production changes