CVE-2021-47600

What it actually does

Use-after-free in dm btree remove during rebalance_children due to dm_tm_unlock called before dm_tm_dec, allowing reference count mishandling on freed tree metadata.

Why it matters to the business

Kernel instability or potential arbitrary code execution on systems using device-mapper btrees, increasing risk for storage or virtualized workloads until patched.

How an attack unfolds

An attacker with local access crafts operations that trigger btree rebalancing in dm, racing the unlock and decrement to reuse freed memory for control-flow hijack; threat actor references to Android kernel RCE patterns indicate possible extension to mobile or embedded Linux environments.

How to fix it

Apply the upstream fix that reorders dm_tm_unlock after dm_tm_dec in rebalance_children; update to a kernel containing the resolution for CVE-2021-47600.

How to confirm the fix worked

Confirm kernel source contains the corrected ordering of unlock and decrement calls; test by exercising dm btree removal paths under memory pressure and verify no UAF reports in debug kernels.

Typical attack path

1. Obtain local execution or trigger via userspace dm-ioctl
2. Manipulate device-mapper targets to force btree node rebalance
3. Trigger the flawed unlock-before-dec sequence
4. Reuse dangling pointer for kernel memory corruption or code execution

How to detect it

Review kernel logs for use-after-free warnings or oops in dm-btree paths; correlate with process activity involving device-mapper targets.

What your security team should do

• Prioritize kernel updates on all systems using device-mapper
• Monitor for local privilege-escalation attempts targeting storage subsystems
• Harden dm access controls and reduce untrusted local user surfaces