CVE-2021-47189

What it actually does

Race condition due to missing memory barriers between normal and ordered work functions in btrfs, allowing async_chunk::inode to transition from non-null to null across threads, leading to use-after-free style crashes in submit_compressed_extents.

Why it matters to the business

Unexplained kernel crashes on ARM64 systems running btrfs can cause unplanned downtime, data access disruption, and require reboots; low EPSS and no KEV status indicate limited immediate widespread risk but still requires patching within normal cycles.

How an attack unfolds

An attacker with local access triggers concurrent btrfs compression and ordered work paths to exploit the missing barriers around WORK_DONE_BIT; on ARM64 this can manifest as a crash when submit_compressed_extents dereferences a now-null inode, though no public exploits or threat actors are associated.

How to fix it

Update to a kernel containing the barrier fix for CVE-2021-47189; for the listed Go package dependency update github.com/couchbase/sync_gateway/db to v2.8.3 or later and rebuild affected applications.

How to confirm the fix worked

Confirm kernel version contains the memory barrier additions around WORK_DONE_BIT in fs/btrfs/async-thread.c; verify Couchbase sync_gateway package version meets or exceeds v2.8.3 and test btrfs compression workloads on ARM64 hardware for stability.

Typical attack path

1. Obtain local code execution on affected Linux system
2. Trigger btrfs compression workloads that schedule async_cow work items
3. Race normal work completion with ordered work execution to bypass WORK_DONE_BIT ordering
4. Cause async_chunk::inode to be observed inconsistently leading to null dereference in submit_compressed_extents

How to detect it

Review kernel logs for call traces containing submit_compressed_extents, async_cow_submit, run_ordered_work and btrfs_work_helper on ARM64; correlate with btrfs compression activity and check for repeated worker thread crashes without other obvious causes.

What your security team should do

• Prioritize patching systems running btrfs on ARM64 within standard maintenance windows given 923 days since publication
• Monitor EPSS trend (currently stable near 0.0067) for any future increase
• Include the fixed package version v2.8.3 in dependency scans for Couchbase sync_gateway deployments