CVE-2021-47226

What it actually does

XRSTOR failure with #PF can modify FPU registers without invalidation of preserved state in __fpu__restore_sig, allowing partial FPU register leakage from one task into a victim task's user-visible FPU context on x86.

Why it matters to the business

Rare cross-process leakage of floating-point register contents could expose sensitive values such as cryptographic material or computation results, increasing risk for workloads relying on kernel isolation on unpatched systems.

How an attack unfolds

An attacker arranges a page unmap from one sibling thread while another executes XRSTOR via signal handling, triggering a fault that leaves stale register state; the victim task then resumes with corrupted FPU registers, disclosing data from the prior context.

How to fix it

Upgrade to a Linux kernel containing the commit that invalidates preserved FPU registers after XRSTOR failure in __fpu__restore_sig; apply vendor kernel packages that include this fix.

How to confirm the fix worked

Inspect kernel source or running binary for the added fpu__drop_fpregs() or equivalent invalidation call immediately after a failed XRSTOR in the signal restoration path; verify no FPU state leakage is possible in concurrent thread tests.

Typical attack path

1. Map shared page and arrange sibling-thread TLB invalidation
2. Force __fpu__restore_sig to execute XRSTOR on the page
3. Induce #PF that alters registers without full failure semantics
4. Allow scheduling so victim task inherits modified FPU state
5. Read leaked register values from user space

How to detect it

Search kernel logs and audit trails for XRSTOR #PF events coinciding with FPU context switches or signal delivery; examine process memory dumps for unexpected FPU register patterns after suspected scheduling races.

What your security team should do

• Prioritize kernel updates on x86 systems handling untrusted signal or FPU workloads
• Review EPSS trend and re-evaluate if new exploit code appears
• Test FPU context-switch behavior after patching to confirm isolation