CVE-2021-47373

What it actually does

Off-by-one error in its_vpe_irq_domain_alloc error path frees one fewer VPE than allocated when its_vpe_init fails, resulting in a kernel memory leak within the GICv3 ITS driver.

Why it matters to the business

Repeated triggering on Linux systems using GICv3 ITS hardware may gradually exhaust kernel memory, leading to resource pressure, instability, or denial of service in virtualized or embedded environments.

How an attack unfolds

An attacker able to induce allocation failures inside the VPE IRQ domain allocator causes incremental unreclaimed VPE structures; no active threat actors or public exploits are associated with this issue.

How to fix it

Apply the upstream fix that passes the correct loop index to the VPE free routine; update to a patched kernel release containing commit resolving the off-by-one in gic-v3-its VPE handling.

How to confirm the fix worked

Inspect the its_vpe_irq_domain_alloc implementation to confirm the number of VPEs passed to the free routine matches the allocation index; boot test systems exercising error paths in the ITS driver.

Typical attack path

1. Locate Linux hosts exposing GICv3 ITS interrupt domains
2. Force its_vpe_init failures via crafted device or hypervisor interactions
3. Trigger repeated domain allocation attempts to accumulate leaked VPE objects
4. Monitor for kernel memory exhaustion symptoms

How to detect it

Review kernel memory statistics and ITS driver logs for unexpected VPE object growth; correlate with device or hypervisor error injection attempts.

What your security team should do

• Prioritize kernel upgrades on all GICv3 ITS platforms
• Review embedded and virtualization fleets for exposure to the ITS driver
• Incorporate memory-leak regression tests for interrupt domain allocators