CVE-2021-47554 is a vulnerability identified in the Linux kernel specifically within the vdpa_sim driver component, which is part of the Virtual Data Path Acceleration (vDPA) framework. The issue arises due to improper handling of the iova_domain structure, which is used for managing IO virtual addresses in the IOMMU subsystem. The vulnerability occurs when an uninitialized iova_domain is passed to the put_iova_domain() function. This can happen if an error occurs before the iova_domain is properly initialized in the vdpasim_create() function. As a result, the kernel attempts to dereference a NULL pointer, leading to a system crash (kernel panic). The crash is evidenced by a NULL pointer dereference at address 0x0, with the call stack involving functions such as __cpuhp_state_remove_instance, put_iova_domain, vdpasim_free, and others related to device release and creation. Additionally, the vulnerability may trigger warnings related to improper invocation of iova_cache_put() without a preceding iova_cache_get(), indicating a misuse of reference counting in the IOMMU iova cache management. This flaw can cause denial of service (DoS) conditions by crashing the kernel, impacting system availability. The vulnerability affects specific Linux kernel versions identified by commit hashes and has been publicly disclosed without a CVSS score or known exploits in the wild at the time of publication. The fix involves ensuring that the iova_domain is fully initialized before it is used and that iova_cache_put() is only called if iova_cache_get() was previously invoked, preventing improper reference handling and NULL pointer dereferences.

For European organizations relying on Linux-based infrastructure, especially those utilizing virtualized environments or data path acceleration features (such as vDPA for high-performance networking in cloud or telecom environments), this vulnerability poses a risk of unexpected system crashes leading to denial of service. The impact is primarily on system availability, potentially disrupting critical services and workloads. Organizations running Linux kernels with the affected vdpa_sim driver may experience instability or downtime if this vulnerability is triggered, either accidentally or through crafted inputs in environments where vDPA devices are managed. While no known exploits are reported, the vulnerability could be leveraged by local attackers or malicious processes with sufficient privileges to cause kernel panics, affecting servers, network appliances, or embedded systems. This could impact sectors such as telecommunications, cloud service providers, and enterprises using Linux-based network acceleration technologies. The confidentiality and integrity of data are not directly compromised by this vulnerability, but operational disruptions could have cascading effects on business continuity and service level agreements.

European organizations should apply the official Linux kernel patches that address CVE-2021-47554 as soon as they become available from their Linux distribution vendors or upstream Linux kernel sources. Specifically, ensure that the vdpa_sim driver and related IOMMU components are updated to versions that include the fix for proper initialization checks of iova_domain and correct reference counting for iova_cache. System administrators should audit their environments to identify usage of vDPA devices and drivers, particularly in virtualized or containerized network acceleration setups. Where immediate patching is not feasible, consider disabling the vdpa_sim driver or vDPA features if they are not critical to operations, to reduce the attack surface. Additionally, implement robust monitoring for kernel crashes and system logs to detect any abnormal behavior related to IOMMU or vDPA components. Employ strict access controls to limit the ability of unprivileged users or processes to interact with kernel modules or device management interfaces that could trigger this vulnerability. Finally, maintain up-to-date backups and incident response plans to quickly recover from potential denial of service incidents.