CVE-2021-47450

What it actually does

Incorrect refcount handling of concatenated stage-2 PGD pages in KVM arm64 protected mode treats the host PGD as a single high-order compound page instead of individual pages, allowing tail-page refcounts to underflow and corrupt page tables.

Why it matters to the business

Virtualized workloads on arm64 systems may experience unexpected crashes or memory corruption in protected KVM configurations, though the flaw shows very low exploitation probability and no observed use in attacks.

How an attack unfolds

An attacker with the ability to influence host stage-2 page-table allocation in protected KVM mode could trigger the refcount bug to corrupt page-table structures; no named threat actors or campaigns are associated with this issue.

How to fix it

Update the Linux kernel to a version containing the hyp_split_page() helper and updated host_s2_zalloc_pages_exact() logic; apply the referenced KVM arm64 fix for stage-2 PGD refcounting.

How to confirm the fix worked

Confirm the presence of hyp_split_page() in the EL2 page allocator and verify that host_s2_zalloc_pages_exact() calls it; check kernel changelog or git history for the CVE fix commit.

Typical attack path

1. Gain sufficient privileges to interact with KVM host stage-2 page-table allocation on arm64
2. Trigger protected-mode PGD allocation paths that rely on the flawed compound-page handling
3. Cause tail-page refcounts to reach zero prematurely
4. Induce page-table corruption leading to host instability or guest escape potential

How to detect it

Examine kernel logs and page allocator traces for unexpected refcount underflows or compound-page handling anomalies during KVM stage-2 PGD operations; no widespread exploitation artifacts have been observed.

What your security team should do

• Prioritize kernel updates on arm64 hosts running protected KVM
• Monitor EPSS and KEV status for any change in exploitation likelihood
• Review virtualization configurations for protected mode usage