CVE-2021-47435 is a race condition vulnerability in the Linux kernel's device mapper (dm) subsystem, specifically related to memory pool (mempool) handling during IO completion. The flaw arises in the dm_io_dec_pending() function, which calls end_io_acct() before decrementing the in-flight pending count of the device mapper. Concurrently, if another task is swapping the device mapper table (dm_swap_table), it may lead to a situation where the mempool pointer becomes NULL. This results in a NULL pointer dereference and kernel crash, as demonstrated by the kernel panic logs referencing mempool_free and related stack traces. The root cause is the improper ordering of operations: end_io_acct() is called before free_io(), which can free the mempool, leaving pointers invalid. The fix involves reordering these calls to ensure pointers remain valid during end_io_acct() execution and establishing stable pointers to struct dm_io members to prevent race conditions. This vulnerability can cause system instability and denial of service (DoS) due to kernel crashes triggered by concurrent IO and device mapper table swaps. It affects Linux kernel versions identified by the commit hash 6a8736d10cb413be95ea443ba40f25c93f4ef9b2 and likely other versions with similar device mapper implementations. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with the affected device mapper code, which is common in enterprise servers, cloud infrastructure, and embedded devices. The device mapper is widely used for logical volume management, RAID, and storage virtualization, making this vulnerability relevant to data centers and critical infrastructure. Exploitation could lead to kernel panics and system crashes, causing denial of service and potential disruption of business operations. Systems handling high IO workloads or frequent device mapper table changes are particularly vulnerable. Although this vulnerability does not directly lead to privilege escalation or data leakage, the resulting instability can impact availability of services, which is critical for sectors such as finance, healthcare, telecommunications, and government services in Europe. Additionally, recovery from kernel crashes may require manual intervention, increasing operational costs and downtime.

European organizations should apply the official Linux kernel patches that reorder the calls in dm_io_dec_pending() and stabilize pointer usage as described in the fix. Until patches are applied, organizations should minimize concurrent device mapper table swaps and IO operations where possible, especially on critical systems. Monitoring kernel logs for signs of mempool NULL pointer dereferences or device mapper related crashes can provide early warning. Employing kernel live patching solutions where available can reduce downtime during patch deployment. Additionally, organizations should ensure robust backup and recovery procedures are in place to mitigate impact from unexpected crashes. For environments using custom or older kernels, backporting the patch or upgrading to a supported kernel version that includes the fix is recommended. Finally, limiting access to systems that can trigger device mapper table swaps to trusted administrators reduces risk of accidental or malicious triggering of the vulnerability.