CVE-2021-47553 is a vulnerability in the Linux kernel related to the handling of CPU hotplug operations, specifically concerning the management of the idle task's stack state when CPUs are offlined and then onlined. The issue arises in the kernel's scheduler code (sched/scs) where the task stack state is not properly reset in the bringup_cpu() function. When Kernel Address Sanitizer (KASAN) and Shadow Call Stacks (SCS) are enabled, stale or poisoned shadow memory and stale SCS stack pointers (SP) can remain associated with the idle task of a CPU that has been offlined. This stale state leads to memory leaks and unusable portions of the shadow call stack after multiple hotplug cycles. The vulnerability stems from a refactoring that moved KASAN and SCS cleanup code into idle thread initialization, which only runs once, rather than before each CPU online event, breaking the intended cleanup process. The fix involves resetting the SCS SP and KASAN shadow for the idle task immediately before a CPU is onlined in bringup_cpu(), ensuring consistent and clean stack state for the idle task. This prevents stale state from affecting execution and eliminates the need for fragile cleanup during idle task exit. The vulnerability does not appear to be exploitable for code execution or privilege escalation, but it can cause memory leaks and bogus KASAN warnings, potentially impacting kernel debugging and reliability during CPU hotplug operations. The issue has been tested on arm64 architectures with various compiler configurations and KASAN/SCS enabled. No known exploits are reported in the wild.

For European organizations, the primary impact of CVE-2021-47553 is on system stability and reliability in environments where CPU hotplugging is used, such as in cloud infrastructure, virtualization hosts, and high-availability servers running Linux kernels with KASAN and SCS enabled. While this vulnerability does not directly lead to remote code execution or privilege escalation, it can cause memory leaks and false-positive kernel warnings that may complicate debugging and monitoring efforts. This could increase operational overhead and risk of misdiagnosis during incident response or system maintenance. Organizations relying on real-time or critical systems that dynamically manage CPU resources might experience degraded performance or unexpected behavior during CPU hotplug cycles. Since KASAN and SCS are primarily used for debugging and security hardening, production systems without these features enabled are less likely to be affected. However, development, testing, and security-hardened environments in European enterprises and research institutions could see an impact. The vulnerability underscores the importance of maintaining up-to-date kernel versions and careful management of CPU hotplug operations in Linux-based systems.

1. Apply the latest Linux kernel patches that address CVE-2021-47553, ensuring the bringup_cpu() function properly resets the idle task's KASAN shadow and SCS SP before CPU online events. 2. For environments using KASAN and SCS, validate kernel versions and configurations to confirm the fix is present. 3. Limit CPU hotplug operations where possible, especially in production environments, to reduce exposure to this issue. 4. Implement monitoring for kernel warnings related to KASAN and shadow call stacks to detect potential stale state issues early. 5. In development and testing environments, ensure that kernel debugging tools are updated and configured to handle CPU hotplug cycles correctly. 6. Coordinate with Linux distribution vendors to receive timely security updates and backports for affected kernel versions. 7. Conduct thorough testing of CPU hotplug functionality after kernel upgrades to confirm system stability. 8. Consider disabling KASAN and SCS in production environments unless explicitly required, to avoid potential side effects from this vulnerability.