CVE-2021-47461

What it actually does

A race condition between userfaultfd_writeprotect() and exit_mmap() during process termination allows concurrent access to memory management structures without proper reference counting, enabling potential use-after-free or invalid memory operations in the kernel.

Why it matters to the business

May lead to kernel instability, crashes, or denial of service in Linux-based systems and devices, increasing operational downtime risk though exploitation remains unlikely given low EPSS and no known campaigns.

How an attack unfolds

An attacker triggers userfaultfd write-protection operations at the exact moment a process exits and its VMAs are torn down by exit_mmap(), bypassing reference checks; the race was originally found via KASAN but the listed Android kernel RCE actor context does not indicate active exploitation of this specific flaw.

How to fix it

Upgrade the Linux kernel to a version containing the mmget_not_zero() fix for userfaultfd operations; apply all subsequent stable updates as they become available.

How to confirm the fix worked

Verify the running kernel includes the referenced mmget_not_zero() change, recompile with KASAN if possible and confirm absence of the race, or inspect mmget_not_zero() usage in userfaultfd_writeprotect() via source review.

Typical attack path

1. Gain local execution context on a Linux system using userfaultfd
2. Arrange concurrent calls to userfaultfd_writeprotect() and process exit that invokes exit_mmap()
3. Trigger the unprotected race window to induce memory corruption or invalid access
4. Attempt to leverage resulting kernel state for denial of service or limited escalation

How to detect it

Search kernel logs and dmesg for KASAN reports or warnings mentioning userfaultfd_writeprotect and exit_mmap; examine process termination patterns coinciding with userfaultfd activity.

What your security team should do

• Prioritize kernel updates on all Linux hosts and Android devices within standard patch windows
• Monitor kernel logs for KASAN or page-fault anomalies involving userfaultfd
• Review workloads that heavily use userfaultfd for additional sandboxing where feasible