Skip to content
Fencer Vulns
high 7.8

CVE-2021-47639 json

KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU

published 2025-02-26 20 mo ago modified 2026-08-05 3 mo ago also EUVD-2021-34665

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU

Zap both valid and invalid roots when zapping/unmapping a gfn range, as KVM must ensure it holds no references to the freed page after returning from the unmap operation. Most notably, the TDP MMU doesn't zap invalid roots in mmu_notifier callbacks. This leads to use-after-free and other issues if the mmu_notifier runs to completion while an invalid root zapper yields as KVM fails to honor the requirement that there must be _no_ references to the page after the mmu_notifier returns.

The bug is most easily reproduced by hacking KVM to cause a collision between set_nx_huge_pages() and kvm_mmu_notifier_release(), but the bug exists between kvm_mmu_notifier_invalidate_range_start() and memslot updates as well. Invalidating a root ensures pages aren't accessible by the guest, and KVM won't read or write page data itself, but KVM will trigger e.g. kvm_set_pfn_dirty() when zapping SPTEs, and thus completing a zap of an invalid root _after_ the mmu_notifier returns is fatal.

WARNING: CPU: 24 PID: 1496 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm] RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm] Call Trace: <TASK> kvm_set_pfn_dirty+0xa8/0xe0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] zap_gfn_range+0x1f3/0x310 [kvm] kvm_tdp_mmu_zap_invalidated_roots+0x50/0x90 [kvm] kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm] set_nx_huge_pages+0xb4/0x190 [kvm] param_attr_store+0x70/0x100 module_attr_store+0x19/0x30 kernfs_fop_write_iter+0x119/0x1b0 new_sync_write+0x11c/0x1b0 vfs_write+0x1cc/0x270 ksys_write+0x5f/0xe0 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK>

Patch / fix

  • Linux Linux 5.15.33, 5.16.19, 5.17.2, 5.18
  • linux Debian 14, Debian 13, Debian 12 5.17.3-1

debian advisories DEBIAN-CVE-2021-47639

  • linux Ubuntu 22.04 LTS 5.15.0-37.39
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1011.14
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1008.12
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1008.10
  • linux-ibm Ubuntu 22.04 LTS 5.15.0-1007.8
  • linux-kvm Ubuntu 22.04 LTS 5.15.0-1010.11
  • linux-azure Ubuntu 22.04 LTS 5.15.0-1010.12
  • linux-raspi Ubuntu 22.04 LTS 5.15.0-1011.13

ubuntu advisories UBUNTU-CVE-2021-47639

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-162.6.1.el9_1
  • perf RHEL 9 5.14.0-162.6.1.el9_1
  • bpftool RHEL 9 5.14.0-162.6.1.el9_1
  • kernel-core RHEL 9 5.14.0-162.6.1.el9_1
  • kernel-tools RHEL 9 5.14.0-162.6.1.el9_1
  • python3-perf RHEL 9 5.14.0-162.6.1.el9_1
  • kernel-modules RHEL 9 5.14.0-162.6.1.el9_1
  • kernel-zfcpdump RHEL 9 5.14.0-162.6.1.el9_1

red hat advisories RHSA-2022:8267RHSA-2022:7683

  • kernel-64kb SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS, SLE High Performance Computing 15 SP5-ESPOS 5.14.21-150500.55.100.1
  • kernel-syms SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.100.1
  • kernel-source SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.100.1
  • kernel-default SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 5.14.21-150500.55.100.1
  • kernel-obs-build SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.100.1
  • kernel-default-base SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.100.1.150500.6.47.1
  • kernel-rt SLE Micro 5.4, SLE Micro 5.3 5.14.21-150400.15.115.1
  • kernel-source-rt SLE Micro 5.4, SLE Micro 5.3 5.14.21-150400.15.115.1

suse advisories SUSE-SU-2025:1241-1SUSE-SU-2025:1183-1SUSE-SU-2025:1176-1SUSE-SU-2025:1027-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-47639 updated cvss 5.5

kernel: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU

  • Red Hat Enterprise Linux 8 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +6 more Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    affected: no fix available “Fix deferred”
  • Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-425.3.1.el8, kernel-debuginfo-common-aarch64 4.18.0-425.3.1.el8, kernel-debuginfo-common-ppc64le 4.18.0-425.3.1.el8
    fixed: vendor fix RHSA-2022:7683
  • Red Hat CodeReady Linux Builder (v. 9) kernel-debuginfo-common-s390x 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-x86_64 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-aarch64 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-ppc64le 5.14.0-162.6.1.el9_1 Red Hat Enterprise Linux AppStream (v. 9) perf 5.14.0-162.6.1.el9_1, kernel-devel-matched 5.14.0-162.6.1.el9_1, kernel-debug-devel-matched 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-s390x 5.14.0-162.6.1.el9_1, kernel-zfcpdump-devel-matched 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-x86_64 5.14.0-162.6.1.el9_1, +2 more
    fixed: vendor fix RHSA-2022:8267
  • Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-425.3.1.el8, kernel 4.18.0-425.3.1.el8, bpftool 4.18.0-425.3.1.el8, kernel-core 4.18.0-425.3.1.el8, kernel-tools 4.18.0-425.3.1.el8, python3-perf 4.18.0-425.3.1.el8, +15 more
    fixed: vendor fix RHSA-2022:7683
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-162.6.1.el9_1, bpftool 5.14.0-162.6.1.el9_1, kernel-core 5.14.0-162.6.1.el9_1, kernel-tools 5.14.0-162.6.1.el9_1, python3-perf 5.14.0-162.6.1.el9_1, kernel-modules 5.14.0-162.6.1.el9_1, +14 more
    fixed: vendor fix RHSA-2022:8267
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 10 kernel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.