CVE-2021-47368

What it actually does

The enetc driver passes a stack-allocated cpumask_t to irq_set_affinity_hint(), which stores only a reference; later reads of the affinity_hint procfs entry via irq_affinity_hint_proc_show() dereference the now-invalid memory, producing a use-after-free that triggers a paging fault oops.

Why it matters to the business

Systems using the enetc Ethernet controller may experience sudden kernel crashes or reboots when any process or monitoring tool reads the affected procfs files, resulting in loss of network connectivity and unplanned downtime.

How an attack unfolds

An attacker with local shell access (or a script running as any user) opens the affinity_hint file under /proc/irq/<irq>/ for an enetc device; the kernel path dereferences the dangling cpumask reference and faults, causing an oops that can be turned into denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit that replaces the temporary cpumask with get_cpu_mask() storage; rebuild and reboot with the fixed kernel image.

How to confirm the fix worked

After patching, confirm the kernel version string contains the fix, then repeatedly cat the affinity_hint procfs entries while monitoring dmesg for absence of enetc-related page faults.

Typical attack path

1. Obtain local user or unprivileged process execution on a system with enetc hardware
2. Read /proc/irq/*/affinity_hint for an enetc IRQ number
3. Kernel follows stale cpumask pointer and triggers paging fault
4. System logs oops and may panic or reboot

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages containing enetc and affinity_hint; correlate with processes that opened affinity_hint procfs entries around the crash time.

• enetc.*affinity_hint
• irq_affinity_hint_proc_show
• page fault.*cpumask

What your security team should do

• Prioritize kernel upgrades on all systems exposing enetc devices
• Add kernel oops and enetc affinity_hint paths to SIEM alerting
• Restrict unprivileged access to /proc/irq where feasible via mount options or SELinux