CVE-2021-47327

What it actually does

Causes a reference count leak in the arm_smmu_device when arm_smmu_rpm_get() fails because pm_runtime_get_sync() increments the refcount without balancing it on error; callers do not decrement, leading to unbalanced refcounts in error paths.

Why it matters to the business

Long-term resource leaks on ARM-based Linux systems can cause gradual memory exhaustion or instability, increasing operational overhead and risk of service disruption on affected devices.

How an attack unfolds

A local attacker triggers error conditions in callers of arm_smmu_rpm_get() to exploit the unbalanced refcount after pm_runtime_get_sync() fails, potentially leading to memory corruption or denial of service.

How to fix it

Upgrade affected packages to the fixed versions provided for each distribution; apply kernel updates that replace pm_runtime_get_sync() with pm_runtime_resume_and_get() in arm_smmu_rpm_get().

How to confirm the fix worked

Confirm the running kernel contains the commit that switches to pm_runtime_resume_and_get(); inspect source or package changelog for the fix description and verify refcount balance in error paths via code review or testing.

Typical attack path

1. Gain local user access on an affected Linux system
2. Invoke code paths that call arm_smmu_rpm_get() and force failure of pm_runtime_get_sync()
3. Trigger repeated error handling to accumulate the refcount leak
4. Leverage resulting memory state for corruption or resource exhaustion

How to detect it

Search kernel logs and audit trails for repeated arm_smmu_rpm_get failures or unusual refcount warnings; examine crash dumps or memory statistics for unexpected growth tied to SMMU device structures.

What your security team should do

• Prioritize patching all ARM SMMU-enabled systems within standard maintenance windows given the local attack vector
• Review systems for use of arm-smmu driver and schedule kernel upgrades
• Monitor for any downstream dependents or embedded devices that may inherit the vulnerable code