CVE-2021-47640

powerpc/kasan: Fix early region not updated correctly

HIGH

7.8

CVSS Score

Published: February 26, 2025 at 01:54 AM UTC

Updated: June 17, 2026 at 04:18 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix early region not updated correctly The shadow's page table is not updated when PTE_RPN_SHIFT is 24 and PAGE_SHIFT is 12. It not only causes false positives but also false negative as shown the following text. Fix it by bringing the logic of kasan_early_shadow_page_entry here. 1. False Positive: ================================================================== BUG: KASAN: vmalloc-out-of-bounds in pcpu_alloc+0x508/0xa50 Write of size 16 at addr f57f3be0 by task swapper/0/1 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.0-12267-gdebe436e77c7 #1 Call Trace: [c80d1c20] [c07fe7b8] dump_stack_lvl+0x4c/0x6c (unreliable) [c80d1c40] [c02ff668] print_address_description.constprop.0+0x88/0x300 [c80d1c70] [c02ff45c] kasan_report+0x1ec/0x200 [c80d1cb0] [c0300b20] kasan_check_range+0x160/0x2f0 [c80d1cc0] [c03018a4] memset+0x34/0x90 [c80d1ce0] [c0280108] pcpu_alloc+0x508/0xa50 [c80d1d40] [c02fd7bc] __kmem_cache_create+0xfc/0x570 [c80d1d70] [c0283d64] kmem_cache_create_usercopy+0x274/0x3e0 [c80d1db0] [c2036580] init_sd+0xc4/0x1d0 [c80d1de0] [c00044a0] do_one_initcall+0xc0/0x33c [c80d1eb0] [c2001624] kernel_init_freeable+0x2c8/0x384 [c80d1ef0] [c0004b14] kernel_init+0x24/0x170 [c80d1f10] [c001b26c] ret_from_kernel_thread+0x5c/0x64 Memory state around the buggy address: f57f3a80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f57f3b00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 >f57f3b80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ f57f3c00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f57f3c80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== 2. False Negative (with KASAN tests): ================================================================== Before fix: ok 45 - kmalloc_double_kzfree # vmalloc_oob: EXPECTATION FAILED at lib/test_kasan.c:1039 KASAN failure expected in "((volatile char *)area)[3100]", but none occurred not ok 46 - vmalloc_oob not ok 1 - kasan ================================================================== After fix: ok 1 - kasan

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v ≥ 5.3.65.11 ≤ v < 5.15.335.16 ≤ v < 5.16.195.17 ≤ v < 5.17.25.3.6 ≤ v < 5.45.4 ≤ v < 5.10.1105.4 ≤ v < 5.15.335.4 ≤ v < 5.16.195.4 ≤ v < 5.17.25.4 ≤ v < 5.185.4 ≤ v < 5.4.1895.5 ≤ v < 5.10.1103822dd8c102d11ada9d9ed8e04cad0b347a046895.3.6 5.4cbd18991e24fea2c31da3bb117c83e4a3538cd11

Vendor states this is fixed in 5a3d8f3192a409893c57808cc935e16484df1068 (fixed)

Vendor states this is fixed in 7f19245c3647afea8c7c41f795506ef70f64b9f2 (fixed)

Vendor states this is fixed in dd75080aa8409ce10d50fb58981c6b59bf8707d3 (fixed)

Vendor states this is fixed in de56beace6648065d404cd9835aa7d30e3df519d (fixed)

Vendor states this is fixed in e3d157a4b4f4e0268c98be5b7013bf4b31234bb6 (fixed)

Vendor states this is fixed in f39a3309393a4a484532f6ba745c6acbcfe06115 (fixed)

Vendor states this is fixed in 5.10.110 (unaffected)

Vendor states this is fixed in 5.15.33 (unaffected)

Vendor states this is fixed in 5.16.19 (unaffected)

Vendor states this is fixed in 5.17.2 (unaffected)

Vendor states this is fixed in 5.18 (unaffected)

Vendor states this is fixed in 5.4 (unaffected)

Vendor states this is fixed in 5.4.189 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references