CVE-2021-47138

What it actually does

Reading invalid hardware register values for server TID base in cxgb4 driver during filter clearing when adapter is in bad state (e.g. after AER fatal error) causes out-of-bound memory access.

Why it matters to the business

Systems using affected network adapters may experience crashes, memory corruption or instability after hardware errors, increasing downtime risk on database and application servers; prevalence across many AlmaLinux 8 deployments raises patch urgency despite low exploit likelihood.

How an attack unfolds

An attacker with local access or ability to induce adapter error state (such as AER fatal error) triggers filter clearing operations that read corrupted register values, resulting in out-of-bound memory access that could be leveraged for further corruption or denial of service.

How to fix it

Upgrade postgresql-server and related packages on AlmaLinux 8 to version 10.21-2.module_el8.6.0+2901+a6abf8d9 or later; apply equivalent kernel fixes containing the cxgb4 register access change; verify update via package manager and reboot if kernel modules are involved.

How to confirm the fix worked

Confirm postgresql packages report version 10.21-2.module_el8.6.0+2901+a6abf8d9 or newer; check kernel logs for absence of cxgb4 register access warnings after simulated adapter error states; re-test filter operations post-update.

Typical attack path

1. Place adapter into bad state via hardware error or AER fatal error
2. Trigger filter clearing code path in cxgb4 driver
3. Read invalid TID base register leading to OOB memory access

How to detect it

Review system logs for cxgb4 driver messages referencing invalid TID base or register reads during filter operations; examine kernel crash dumps or OOM events correlated with adapter error states.

What your security team should do

• Prioritize patching postgresql-server and dependent packages on all AlmaLinux 8 hosts within standard change windows
• Monitor EPSS and KEV status for any future increase in exploit activity
• Include cxgb4 driver error paths in routine kernel stability testing