CVE-2021-47296

What it actually does

The flaw is a missing vcpu_put call in kvm_arch_vcpu_ioctl on PowerPC KVM when a user-space copy fails, leaving the vCPU in a loaded state and corrupting preempt notifiers.

Why it matters to the business

Virtualized workloads on PowerPC systems may experience sudden crashes or instability, disrupting hosted services and requiring manual intervention or restarts.

How an attack unfolds

An attacker with local access to issue KVM ioctls crafts a call that triggers a failing user copy, bypassing the expected vcpu_put and causing notifier state corruption that can be leveraged for denial of service.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix that ensures vcpu_put is always invoked on user copy failure in kvm_arch_vcpu_ioctl.

How to confirm the fix worked

Confirm the presence of the vcpu_put call after the user copy in the kvm_arch_vcpu_ioctl function for the affected PowerPC KVM code path, or verify the running kernel includes the referenced commit.

Typical attack path

1. Obtain local access on a PowerPC KVM host
2. Issue a crafted kvm_arch_vcpu_ioctl that forces a user copy failure
3. Trigger the missing vcpu_put path to corrupt preempt notifier state
4. Induce kernel panic or crash

How to detect it

Search kernel logs and crash dumps for preempt notifier corruption warnings or oops traces originating from KVM vCPU unload paths on PowerPC systems.

What your security team should do

• Prioritize kernel updates on all PowerPC KVM hosts
• Review and restrict untrusted local access to KVM device nodes
• Monitor kernel logs for preempt notifier or KVM-related oops and panics