CVE-2021-47090

What it actually does

Refcount handling error in hwpoison soft-offline path retains MF_COUNT_INCREASED flag on retry of get_any_page without incrementing page reference count, triggering VM_BUG_ON_PAGE(page_ref_count==0) and kernel panic in release_pages during unmap or process exit.

Why it matters to the business

Local processes can trigger kernel crashes that reboot or halt Linux systems, causing denial of service and service disruption; low EPSS and no KEV status indicate limited real-world exploitation risk despite the 960-day-old flaw.

How an attack unfolds

An attacker with local access calls madvise(MADV_SOFT_OFFLINE) on memory regions that exercise the hwpoison retry path; the retained flag without refcount increment leads to invalid page state and panic when the kernel later releases pages during unmapping or exit.

How to fix it

Upgrade to a Linux kernel containing the hwpoison fix that clears MF_COUNT_INCREASED before retrying get_any_page; apply distribution kernel updates that backport the change.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; run targeted madvise(MADV_SOFT_OFFLINE) tests and verify absence of release_pages BUG or page_ref_count panics in dmesg.

Typical attack path

1. Local process invokes madvise syscall with MADV_SOFT_OFFLINE
2. Targets pages that cause get_any_page retry
3. MF_COUNT_INCREASED flag remains set without refcnt increase
4. Kernel hits BUG in release_pages during tlb_flush or exit_mmap
5. System panics and may reboot or halt

How to detect it

Inspect dmesg, kern.log, and systemd journal for panic traces containing release_pages, VM_BUG_ON_PAGE(page_ref_count(page)==0), hwpoison, or madvise-related call stacks around process termination events.

• kernel BUG at include/linux/mm.h:737
• release_pages+0x53f/0x840
• VM_BUG_ON_PAGE(page_ref_count(page) == 0)
• MADV_SOFT_OFFLINE triggered panic in put_page_testzero

What your security team should do

• Prioritize kernel updates on all Linux hosts
• Limit unprivileged use of madvise where possible via capabilities or seccomp
• Monitor kernel logs for hwpoison and release_pages panic signatures
• Test patched kernels in staging before broad rollout given the memory subsystem impact