CVE-2021-47290 is a vulnerability identified in the Linux kernel's SCSI target subsystem, specifically within the target_core_mod module that handles SCSI target operations. The flaw arises from a NULL pointer dereference triggered during the completion of EXTENDED COPY (XCOPY) commands. The vulnerability is rooted in the way CPU affinity control was implemented for command completion work queues. A commit (39ae3edda325) introduced configurable CPU affinity for target_complete_cmd(), which queues work on a CPU based on the se_tpg_wwn->cmd_compl_affinity state. However, the EXTENDED COPY worker uses a global xcopy_pt_tpg structure that has a NULL se_tpg_wwn pointer after initialization. When read/write commands initiated by EXTENDED COPY complete, the code dereferences this NULL pointer, leading to a kernel NULL pointer dereference and consequent crash (BUG). This can cause denial of service by crashing the kernel or destabilizing the system. The fix involves modifying target_complete_cmd() to queue work on se_cmd->cpuid if se_tpg_wwn is NULL, preventing the NULL pointer dereference. The vulnerability affects Linux kernel versions containing the specified commit and is relevant to systems using the Linux SCSI target framework, particularly those leveraging the EXTENDED COPY feature for storage operations. There are no known exploits in the wild as of the publication date, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2021-47290 primarily revolves around availability and system stability. Systems running Linux kernels with the vulnerable SCSI target implementation, especially those acting as storage servers or SAN targets using EXTENDED COPY commands, may experience kernel crashes leading to denial of service. This can disrupt critical storage operations, affecting data availability and potentially causing downtime for services relying on these storage backends. Organizations in sectors with high reliance on Linux-based storage infrastructure—such as cloud providers, data centers, financial institutions, and telecommunications—may face operational interruptions. Although this vulnerability does not directly expose confidentiality or integrity risks, the resulting instability could indirectly impact business continuity and service-level agreements. The absence of known exploits reduces immediate risk, but the vulnerability's presence in kernel code used widely across servers and storage appliances means that targeted attacks or accidental triggering could have significant operational consequences.

To mitigate CVE-2021-47290, European organizations should: 1) Apply the official Linux kernel patches that address this vulnerability as soon as they become available from trusted sources or distributions. 2) Identify and inventory systems using the Linux SCSI target framework, particularly those utilizing EXTENDED COPY functionality, to prioritize patching efforts. 3) If immediate patching is not feasible, consider disabling or restricting the use of EXTENDED COPY commands or the SCSI target functionality on affected systems to reduce exposure. 4) Implement monitoring for kernel crashes or unusual SCSI target subsystem logs that could indicate attempts to trigger this vulnerability. 5) Engage with hardware and storage appliance vendors to confirm whether their products incorporate vulnerable Linux kernel versions and request firmware or software updates. 6) Incorporate this vulnerability into incident response and vulnerability management workflows to ensure timely detection and remediation. These steps go beyond generic advice by focusing on the specific subsystem and usage patterns related to the vulnerability.