CVE-2021-47060

What it actually does

Use-after-free in KVM coalesced MMIO handling: kvm_io_bus_unregister_dev() can destroy the bus and delete list entries on allocation failure without signaling the caller, leaving the coalesced_zones walk to dereference freed entries.

Why it matters to the business

Virtualized Linux hosts may experience kernel crashes or memory corruption during VM I/O operations, leading to guest downtime, potential host compromise, and operational disruption in environments relying on KVM.

How an attack unfolds

An attacker with access to trigger KVM MMIO zone registration and a concurrent memory pressure condition causes kvm_io_bus_unregister_dev to fail allocation, destroy the bus, and delete list nodes; the ongoing walk then dereferences the freed coalesced_zones entries, enabling use-after-free exploitation for crash or escalation.

How to fix it

Apply the upstream fix that aborts the zone walk when the bus is destroyed and adds braces to the for-loop; rebuild and deploy updated Linux kernels containing the resolution for CVE-2021-47060.

How to confirm the fix worked

Confirm the patched kernel source contains the early-return check after kvm_io_bus_unregister_dev failure and the added curly braces around the coalesced MMIO for-loop; test by exercising MMIO zone registration under memory pressure and verifying no list corruption occurs.

Typical attack path

1. Obtain ability to perform MMIO operations inside a KVM guest or on the host
2. Register coalesced MMIO zones while inducing memory allocation pressure
3. Force kvm_io_bus_unregister_dev to fail and obliterate the bus
4. Continue iterating the now-deleted coalesced_zones list to trigger the UAF

How to detect it

Review kernel logs for KVM MMIO-related oops or panic messages involving list traversal after bus unregistration; correlate with guest I/O activity and memory allocation failures on the host.

What your security team should do

• Prioritize kernel updates on all KVM hosts within standard change windows
• Monitor EPSS and KEV status for any future increase in observed exploitation
• Harden guest isolation and limit untrusted code execution on hosts until patched