{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-46910", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-25T13:45:52.718Z", "datePublished": "2024-02-27T06:53:50.828Z", "dateUpdated": "2026-08-05T08:45:00.985Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:00.985Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled\n\nThe debugging code for kmap_local() doubles the number of per-CPU fixmap\nslots allocated for kmap_local(), in order to use half of them as guard\nregions. This causes the fixmap region to grow downwards beyond the start\nof its reserved window if the supported number of CPUs is large, and collide\nwith the newly added virtual DT mapping right below it, which is obviously\nnot good.\n\nOne manifestation of this is EFI boot on a kernel built with NR_CPUS=32\nand CONFIG_DEBUG_KMAP_LOCAL=y, which may pass the FDT in highmem, resulting\nin block entries below the fixmap region that the fixmap code misidentifies\nas fixmap table entries, and subsequently tries to dereference using a\nphys-to-virt translation that is only valid for lowmem. This results in a\ncryptic splat such as the one below.\n\n ftrace: allocating 45548 entries in 89 pages\n 8<--- cut here ---\n Unable to handle kernel paging request at virtual address fc6006f0\n pgd = (ptrval)\n [fc6006f0] *pgd=80000040207003, *pmd=00000000\n Internal error: Oops: a06 [#1] SMP ARM\n Modules linked in:\n CPU: 0 PID: 0 Comm: swapper Not tainted 5.11.0+ #382\n Hardware name: Generic DT based system\n PC is at cpu_ca15_set_pte_ext+0x24/0x30\n LR is at __set_fixmap+0xe4/0x118\n pc : [] lr : [] psr: 400000d3\n sp : c1601ed8 ip : 00400000 fp : 00800000\n r10: 0000071f r9 : 00421000 r8 : 00c00000\n r7 : 00c00000 r6 : 0000071f r5 : ffade000 r4 : 4040171f\n r3 : 00c00000 r2 : 4040171f r1 : c041ac78 r0 : fc6006f0\n Flags: nZcv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none\n Control: 30c5387d Table: 40203000 DAC: 00000001\n Process swapper (pid: 0, stack limit = 0x(ptrval))\n\nSo let's limit CONFIG_NR_CPUS to 16 when CONFIG_DEBUG_KMAP_LOCAL=y. Also,\nfix the BUILD_BUG_ON() check that was supposed to catch this, by checking\nwhether the region grows below the start address rather than above the end\naddress." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is in ARM fixmap/kmap_local setup and is reached during local boot or local highmem kmap activity; there is no network protocol or remote packet path into this code.\nAC:H - Exploitation requires the rare non-default DEBUG_KMAP_LOCAL debug option (explicitly \"Disable for production use\") together with a large NR_CPUS (e.g. 32), which is beyond normal attacker control.\nPR:L - On a system that boots with the vulnerable config, an unprivileged local user can exercise kmap_local via ordinary highmem-backed operations scheduled on high CPU IDs; admin/root capabilities are not required.\nUI:N - No victim action such as mounting a filesystem or opening a crafted file is required; boot or normal local workload activity is sufficient.\nS:U - Impact remains within the same kernel security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - With DEBUG_KMAP_LOCAL and large NR_CPUS, kmap_local used linear PTE indexing (kmap_pte - idx) that writes out of bounds into adjacent memory, which is memory corruption that can be leveraged for information disclosure.\nI:H - The same out-of-bounds PTE store is an out-of-bounds kernel write, and the fixmap/FDT collision can also cause page-table updates through misidentified section mappings, enabling integrity compromise and control-flow hijacking potential.\nA:H - The documented manifestation is a kernel oops during boot (and equivalent faults on bad fixmap walks), which is a full availability loss via crash/panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/arm/Kconfig", "arch/arm/mm/mmu.c" ], "versions": [ { "version": "2a15ba82fa6ca3f35502b3060f22118a938d2889", "lessThan": "5965ac11b1d5fcb38464728931649cd9df79c7c9", "status": "affected", "versionType": "git" }, { "version": "2a15ba82fa6ca3f35502b3060f22118a938d2889", "lessThan": "d624833f5984d484c5e3196f34b926f9e71dafee", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/arm/Kconfig", "arch/arm/mm/mmu.c" ], "versions": [ { "version": "5.11", "status": "affected" }, { "version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.11.16", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.11.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5965ac11b1d5fcb38464728931649cd9df79c7c9" }, { "url": "https://git.kernel.org/stable/c/d624833f5984d484c5e3196f34b926f9e71dafee" } ], "title": "ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:42.862Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/5965ac11b1d5fcb38464728931649cd9df79c7c9", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/d624833f5984d484c5e3196f34b926f9e71dafee", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-46910", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:02:10.448289Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:34.915Z" } } ] } }