CVE-2021-47623

What it actually does

Unmapping fixmap entries on powerpc by calling __set_fixmap with FIXMAP_PAGE_CLEAR invokes map_kernel_page a second time on the same page, triggering a WARNING at set_pte_at and leaving the PTE in an inconsistent state.

Why it matters to the business

Systems running affected Linux kernels on PowerPC hardware may experience boot-time warnings, initialization failures, or reduced stability when legacy serial console or early ioremap paths are exercised, increasing operational overhead until patched.

How an attack unfolds

An attacker with the ability to trigger early_iounmap or ioremap_legacy_serial_console paths during kernel initialization (for example via crafted boot parameters or specific hardware configurations) can force repeated mapping attempts on the same fixmap slot, surfacing the warning and potentially corrupting kernel page table state.

How to fix it

Upgrade to a fixed kernel package: Debian 12/13 to 5.15.15-1 or later; Ubuntu 20.04 LTS series to the listed 5.4.0 or 5.15.0 point releases (for example linux 5.4.0-9.12, linux-aws 5.4.0-1005.5, linux-azure-5.15 5.15.0-1007.8~20.04.1, etc.) and reboot.

How to confirm the fix worked

Verify running kernel version matches or exceeds the fixed package for the distribution; confirm absence of the set_pte_at WARNING during early_iounmap paths; run distribution-specific package checks and kernel config tests for fixmap unmap behavior.

Typical attack path

1. Trigger early console or legacy ioremap initialization during boot
2. Cause __set_fixmap(FIXMAP_PAGE_CLEAR) to be invoked on an already-mapped entry
3. map_kernel_page calls set_pte_at on a live PTE, emitting the warning
4. Kernel continues with potentially stale or double-mapped fixmap entry

How to detect it

Search kernel logs for the exact WARNING string at set_pte_at+0xc during early boot or ioremap_legacy_serial_console; inspect dmesg or journalctl output on PowerPC systems for the call trace involving __set_fixmap and map_kernel_page.

• WARNING: CPU:.*at arch/powerpc/mm/pgtable.c:194 set_pte_at
• NIP.*set_pte_at+0xc/0x1e8
• LR.*map_kernel_page+0x9c/0x100
• early_iounmap.*__set_fixmap

What your security team should do

• Apply the exact fixed kernel packages listed for each affected distribution immediately
• Prioritize PowerPC systems that use legacy serial console or early ioremap
• Monitor EPSS and KEV status for any future changes in exploit maturity
• Test patched kernels in staging environments before broad rollout