CVE-2021-47354

What it actually does

Race condition in the DRM scheduler allows a job to be killed before all of its dependencies complete, resulting in data corruption.

Why it matters to the business

Systems may experience silent data corruption that disrupts operations, requires recovery efforts, and risks loss of data integrity; the issue affects widely deployed GitLab environments with a CISA-style remediation expectation implied by publication age.

How an attack unfolds

An attacker with network access triggers job scheduling paths that race a termination request against still-pending dependencies, causing the kernel scheduler to abort the job prematurely and corrupt dependent data structures.

How to fix it

Upgrade GitLab to the version containing commit 7fc27fe692abccaed7e2e0ebfea2aadf5140593f; apply the kernel patch that ensures all job dependencies complete before termination.

How to confirm the fix worked

Confirm the running kernel or GitLab package contains commit 7fc27fe692abccaed7e2e0ebfea2aadf5140593f and test that job-kill paths now wait for dependency completion.

Typical attack path

1. Reach a network-accessible GitLab instance running an affected kernel build
2. Submit or influence workloads that enqueue DRM scheduler jobs with dependencies
3. Force or time a job-kill operation while dependencies remain incomplete
4. Observe or leverage resulting data corruption for further impact

How to detect it

Review kernel and GitLab scheduler logs for job termination events that occur while dependencies are still listed as pending; correlate with any subsequent data-integrity alerts.

What your security team should do

• Apply the fixed commit 7fc27fe692abccaed7e2e0ebfea2aadf5140593f to all GitLab instances without delay
• Prioritize patching given 882 days of public exposure and the high CVSS
• Monitor for any downstream dependents that embed the vulnerable scheduler code