CVE-2021-47396

What it actually does

The mac80211-hwsim hrtimer for beacon transmission fails to correctly advance when the timer fires late due to scheduling delays, causing repeated attempts to schedule for past deadlines and resulting in accumulating stalls or misaligned beacon delivery.

Why it matters to the business

Wireless simulation environments may experience unpredictable delays or stalls during testing and development, potentially slowing validation of wireless drivers and protocols without affecting production wireless hardware.

How an attack unfolds

An attacker or fuzzer induces vCPU scheduling delays that cause the hrtimer to fire late; the flawed rearming logic then repeatedly targets past deadlines, leading to prolonged stalls in the simulation until the timer catches up.

How to fix it

Update the Linux kernel to the version containing the fix that replaces the incorrect hrtimer rearming logic with hrtimer_forward_now() to ensure the next timer expiration aligns with the subsequent interval after the current time.

How to confirm the fix worked

Confirm the presence of the hrtimer_forward_now() change in the mac80211-hwsim beacon timer code and run regression tests that deliberately introduce scheduling latency to verify stable beacon alignment.

Typical attack path

1. Trigger scheduling latency on the vCPU running the mac80211-hwsim timer
2. Allow the hrtimer to fire after the intended beacon interval has passed
3. Observe repeated attempts to rearm the timer for already-expired deadlines
4. Sustain the condition to accumulate stalls in beacon handling

How to detect it

Review kernel logs on systems running mac80211-hwsim for repeated messages about missed or late beacon timers and correlate with periods of high scheduling latency or syzbot-style fuzzing activity.

What your security team should do

• Apply the kernel update containing the hrtimer_forward_now() fix to all affected simulation hosts
• Prioritize patching in CI/CD and developer environments that rely on mac80211-hwsim
• Monitor for future similar timer-handling issues in wireless simulation modules