CVE-2021-47463

What it actually does

NULL pointer dereference in page_is_secretmem() during internal_get_user_pages_fast when page->mapping is cleared by concurrent reclaim or truncation, causing kernel oops in KVM GUP paths.

Why it matters to the business

Unexpected kernel crashes on Linux systems running KVM or similar workloads that use secretmem, leading to denial of service, guest VM instability, and operational downtime; low public exploitability but high impact in virtualized environments.

How an attack unfolds

An attacker with local access or control over a KVM guest triggers get_user_pages_fast operations on secretmem-backed memory while simultaneously causing page reclamation or truncation to nullify the mapping pointer, resulting in a kernel NULL dereference panic.

How to fix it

Update to a Linux kernel containing the fix for mm/secretmem NULL mapping dereference in page_is_secretmem; apply the stable backport or newer mainline release that checks for NULL mapping before dereference.

How to confirm the fix worked

Confirm kernel version includes the secretmem mapping NULL check; attempt to reproduce the GUP + reclaim race in a test environment and verify absence of NULL dereference oops; review dmesg for prior occurrences of the described BUG.

Typical attack path

1. Map secretmem pages accessible to a process or KVM guest
2. Initiate fast GUP operations from userspace or hypervisor path
3. Trigger concurrent reclaim or file truncation to clear page->mapping
4. Dereference the now-NULL mapping inside page_is_secretmem during GUP
5. Kernel oops and system or VM crash

How to detect it

Search kernel logs and dmesg for 'BUG: kernel NULL pointer dereference' combined with 'internal_get_user_pages_fast' and 'page_is_secretmem'; inspect KVM-related call traces involving hva_to_pfn and direct_page_fault; review audit logs for processes triggering rapid memory mapping and reclaim activity.

What your security team should do

• Prioritize kernel updates on all systems hosting KVM or using secretmem
• Monitor for kernel oops logs matching the NULL dereference pattern in internal_get_user_pages_fast
• Restrict untrusted local access and KVM guest capabilities until patched
• Test updated kernels in staging before broad deployment due to memory management changes