CVE-2021-47256

What it actually does

Race condition in mm/memory-failure handling skips wait_on_page_writeback after __munlock_pagevec clears LRU without lock_page, allowing truncate_error_page to remove mapping before end_page_writeback clears i_wb_list, triggering BUG_ON in clear_inode during evict/iput.

Why it matters to the business

Kernel panics on Linux systems cause unplanned reboots, service outages, and potential filesystem or data corruption in production workloads.

How an attack unfolds

An attacker crafts sequences of mmap, munlock_vma_pages_range, and memory-failure paths (via fuzzing or targeted unmap operations) to reach identify_page_state without the writeback wait, leading to inode eviction panic on unlink or similar file operations.

How to fix it

Upgrade the Linux kernel to a version containing the memory-failure fix that adds PageWriteback check before deciding to skip wait_on_page_writeback; rebuild and reboot affected systems.

How to confirm the fix worked

Inspect kernel source for PageWriteback guard in identify_page_state or memory_failure; confirm absence of the BUG_ON path in clear_inode after applying the update and re-test with reproducer workloads.

Typical attack path

1. Perform mmap and subsequent munlock on pages
2. Trigger memory_failure path that omits writeback synchronization
3. Cause truncate_error_page to drop page mapping while writeback is pending
4. Evict inode via iput to hit BUG_ON on non-empty i_wb_list

How to detect it

Search kernel logs and crash dumps for clear_inode BUG_ON messages referencing i_wb_list, ext4_clear_inode, or munlock_pagevec call stacks; correlate with processes performing unlink or munmap around the time of panic.

• BUG_ON(!list_empty(&inode->i_wb_list))
• clear_inode+0x280/0x2a8
• Kernel panic - not syncing: Fatal exception
• __munlock_pagevec
• ext4_evict_inode

What your security team should do

• Prioritize kernel updates on all exposed Linux hosts
• Enable panic_on_oops and centralize kernel log collection for rapid detection
• Review workloads using heavy mmap/munlock patterns for additional hardening