CVE-2021-47465 is a high-severity vulnerability in the Linux kernel specifically affecting the KVM (Kernel-based Virtual Machine) implementation on PowerPC (PPC) Book3S hypervisor (HV) architectures. The issue arises from improper stack handling in the function idle_kvm_start_guest(), which was introduced as a replacement for kvm_start_guest() in commit 10d91611f426. The vulnerability stems from the misuse of the emergency stack allocated per CPU. Unlike the regular kernel stack, the emergency stack pointer (emergency_sp) points just above the allocated stack memory and requires careful frame creation before storing data. idle_kvm_start_guest() incorrectly stores critical registers such as the condition register (CR) and link register (LR) into the caller’s frame on the emergency stack without properly creating a frame first. Furthermore, the stack frame created is too small to hold all non-volatile registers, causing writes beyond the allocated emergency stack boundaries. This results in corruption of memory regions adjacent to the emergency stack, specifically 0-24 bytes and 112-248 bytes above the allocated stack. Although this corruption has gone unnoticed due to the adjacent memory typically being used by other stacks (e.g., IRQ stacks or other CPUs’ emergency stacks), it poses a risk of unpredictable behavior, data corruption, or system crashes under certain conditions. The fix involves correctly saving CR/LR into the caller’s frame using the existing stack pointer on entry, creating an adequately sized SWITCH_FRAME_SIZE frame on the emergency stack with proper backchain linkage, and switching to this new frame to prevent out-of-bounds writes. This vulnerability requires local privileges with low complexity to exploit and does not require user interaction. It impacts the integrity and availability of affected systems but does not directly affect confidentiality. The CVSS v3.1 score is 7.1 (high), reflecting these factors.

For European organizations running Linux on PowerPC Book3S HV platforms with KVM enabled, this vulnerability could lead to system instability, data corruption, or denial of service due to stack corruption in critical hypervisor code. Organizations relying on virtualization for critical infrastructure, cloud services, or embedded systems using affected Linux kernel versions may experience unexpected crashes or compromised system integrity. While exploitation requires local access with some privileges, insider threats or compromised accounts could leverage this flaw to disrupt services or escalate issues within virtualized environments. The impact on availability is significant, and integrity breaches could affect workloads running on the affected hypervisor. Given the niche architecture (PowerPC Book3S), the threat is more relevant to specialized environments such as telecommunications, industrial control systems, or research institutions using PPC-based servers or appliances. European entities in these sectors should be particularly vigilant. The lack of known exploits in the wild reduces immediate risk but does not eliminate the need for prompt remediation.

1. Apply the official Linux kernel patches that address CVE-2021-47465 as soon as they are available from trusted sources or Linux distributions maintaining PPC kernel branches. 2. For organizations using custom or embedded Linux kernels on PPC Book3S HV platforms, backport the fix from commit 10d91611f426 or later stable releases to ensure proper emergency stack handling. 3. Restrict local access to systems running affected kernels to trusted personnel only, minimizing the risk of exploitation by unprivileged users. 4. Monitor system logs and kernel crash reports for anomalies related to stack corruption or unexpected KVM guest failures. 5. Implement strict privilege separation and use security modules (e.g., SELinux, AppArmor) to limit the ability of local users to execute or influence hypervisor code paths. 6. Conduct thorough testing of updated kernels in staging environments before deployment to production to ensure stability and compatibility. 7. Maintain up-to-date inventory of systems running PPC Book3S HV kernels to prioritize patching and risk assessment.