CVE-2021-47140

What it actually does

The flaw leaves dev->dma_ops uncleared on AMD IOMMU when a device is switched from a DMA domain to an identity domain via sysfs, so subsequent DMA allocations invoke iommu_dma_alloc on an identity domain and dereference a NULL pointer.

Why it matters to the business

Administrators performing domain-type changes on AMD systems can trigger immediate kernel oopses and reboots, producing unplanned downtime and loss of availability for affected workloads.

How an attack unfolds

An attacker with root access writes to the PCI driver's unbind and the iommu_group/type sysfs nodes to force an identity domain, then rebinds the device; the next DMA allocation path dereferences the stale dma_ops pointer and crashes the kernel.

How to fix it

Upgrade the Linux kernel to a version containing the fix that clears dma_ops inside probe_finalize. For the listed AlmaLinux packages apply xz (AlmaLinux:9) 5.2.5-8.el9_0, xz-devel (AlmaLinux:9) 5.2.5-8.el9_0, xz-libs (AlmaLinux:9) 5.2.5-8.el9_0 and xz-lzma-compat (AlmaLinux:9) 5.2.5-8.el9_0.

How to confirm the fix worked

After patching, repeat the exact sysfs sequence that previously triggered the oops and confirm the kernel no longer crashes; also verify the presence of the dma_ops-clearing code in iommu_change_dev_def_domain.

Typical attack path

1. echo PCI_BDF > /sys/bus/pci/drivers/.../unbind
2. echo identity > /sys/bus/pci/devices/PCI_BDF/iommu_group/type
3. echo PCI_BDF > /sys/bus/pci/drivers/.../bind
4. Trigger device open or DMA allocation that calls iommu_dma_alloc

How to detect it

Search kernel logs for the exact BUG line "kernel NULL pointer dereference" immediately after any sysfs iommu_group/type write; correlate with device unbind/rebind events in audit logs.

What your security team should do

• Apply the fixed kernel and xz package versions immediately on all AMD IOMMU systems that expose sysfs domain controls.
• Restrict write access to /sys/bus/pci/.../iommu_group/type to the minimum necessary accounts.
• Monitor EPSS and KEV status; although currently low, re-evaluate if new exploit code appears.