CVE-2021-47325

What it actually does

The flaw causes a reference count leak in arm_smmu_iova_to_phys_hard when error paths are taken after arm_smmu_rpm_get has incremented the smmu device refcount, without a matching decrement on the out label.

Why it matters to the business

Over time the leak can exhaust kernel resources on systems performing IOMMU address translation, leading to degraded stability or availability of virtualization and device passthrough workloads.

How an attack unfolds

An attacker triggers one of the documented error conditions inside arm_smmu_iova_to_phys_hard after the refcount has been raised, leaving the reference permanently elevated; repeated triggering slowly consumes resources that may be chained with other bugs for denial of service or memory corruption.

How to fix it

Upgrade affected packages to the listed fixed versions (firefox 118.0.1+build1-0ubuntu0.20.04.1 on Ubuntu 20.04 LTS) and reboot or reload the IOMMU driver as required by the distribution.

How to confirm the fix worked

Confirm the patch is present by inspecting the arm_smmu_iova_to_phys_hard function for the added jump to the out label on error paths; run regression tests that exercise the error conditions and verify refcount balance with kernel debugging facilities.

Typical attack path

1. Obtain code execution or the ability to induce IOMMU translation faults on the target
2. Force execution through an error path in arm_smmu_iova_to_phys_hard after rpm_get
3. Repeat the sequence to accumulate leaked references
4. Combine with secondary techniques to convert the leak into a larger impact

How to detect it

Inspect kernel logs and IOMMU debug output for repeated translation faults that coincide with rising reference counts or memory-pressure events; correlate with process activity that exercises hardware address translation.

What your security team should do

• Apply the vendor-supplied updates immediately on all systems exposing IOMMU functionality
• Prioritize hosts that perform device assignment or nested virtualization
• Review kernel and IOMMU logs for unusual refcount or memory-pressure warnings