CVE-2021-46993

What it actually does

Out-of-bound memory access in the Linux kernel scheduler's uclamp bucket mapping caused by off-by-one error when computing bucket size from clamp values using rounding division, allowing a clamp of 1024 to index beyond the allocated bucket array.

Why it matters to the business

Linux systems using util-clamp scheduling may experience kernel instability, crashes, or memory corruption that disrupts workloads and requires restarts or patches to restore reliability.

How an attack unfolds

An attacker with local access configures task clamp values that trigger the off-by-one bucket index calculation, causing the kernel to read or write beyond the uclamp bucket array boundaries and potentially leading to privilege escalation or denial of service.

How to fix it

Apply the upstream kernel patch that clamps the computed bucket id to the valid range [0, bucket_count-1] and update to a kernel version containing the fix for sched uclamp bucket sizing.

How to confirm the fix worked

Verify the presence of the uclamp bucket clamp fix in the running kernel source or changelog, test with workloads that set maximum clamp values, and confirm no out-of-bound accesses occur under those conditions.

Typical attack path

1. Obtain local execution context on a vulnerable Linux kernel
2. Create or modify tasks to set specific util-clamp values near the maximum
3. Trigger scheduler code paths that map the clamp value to a bucket index
4. Induce out-of-bound access through the miscalculated bucket id
5. Leverage resulting memory corruption for further exploitation or crash

How to detect it

Review kernel logs for scheduler-related oops, panic, or out-of-bound access messages; inspect task clamp configurations and correlate with any unexplained crashes on systems running vulnerable kernels.

What your security team should do

• Prioritize kernel updates on systems that enable util-clamp scheduling
• Audit configurations for use of uclamp to assess exposure
• Monitor for kernel oops or panic logs related to scheduler memory access
• Test patched kernels in staging before broad deployment