CVE-2021-47003

What it actually does

Null pointer dereference in idxd_cmd_exec when a null status pointer is passed after a recent commit introduced an unconditional assignment to *status, resulting in kernel memory corruption or panic.

Why it matters to the business

Unexpected system crashes or instability on Linux systems using the idxd DMA engine, potentially causing downtime for dependent services and workloads.

How an attack unfolds

An attacker with local access crafts input that reaches the vulnerable idxd_cmd_exec call path with a null status pointer, triggering the dereference and kernel fault; no widespread exploitation observed.

How to fix it

Update to a Linux kernel version containing the null-check fix for idxd_cmd_exec; apply vendor-supplied kernel updates as they become available.

How to confirm the fix worked

Verify kernel source or binary contains the status null-check before the assignment in idxd_cmd_exec; test affected code paths with null status inputs to confirm no crash.

Typical attack path

1. Obtain local code execution on affected Linux kernel
2. Trigger DMA engine command submission via idxd interface with specific parameters
3. Pass null status pointer to idxd_cmd_exec
4. Cause dereference and kernel panic or corruption

How to detect it

Review kernel logs for oops or panic messages referencing idxd_cmd_exec or null pointer dereference in dmaengine; inspect recent kernel crash dumps for idxd-related call stacks.

What your security team should do

• Prioritize kernel updates on systems using idxd DMA hardware
• Monitor kernel logs for null dereference oops in idxd paths
• Restrict unprivileged local access where possible until patched