CVE-2021-47584 is a vulnerability identified in the Linux kernel's iocost subsystem, which manages I/O cost control for block devices. The flaw arises from a divide-by-zero error in the donation calculation logic of the iocost controller when handling cgroups (control groups) with very low active hweight values. The iocost subsystem uses a donation mechanism to redistribute I/O bandwidth among cgroups based on their active weights (hweight). The vulnerability was introduced after a revision (commit f1de2439ec43) that made the donation calculation more precise, allowing cgroups with low active hweight (even as low as 1) to donate I/O bandwidth. However, the logic assumed that the donor cgroup would always have an after-donation hweight of at least 1, which is not true for cgroups with active hweight of 1. This leads to a division by zero during the donation calculation, causing a kernel oops (crash) and triggering warnings in the kernel logs. The issue manifests as a kernel panic or crash, impacting system stability and availability. The fix involves excluding cgroups with active hweight less than 2 from participating in donation, which prevents the divide-by-zero condition without significantly affecting I/O work conservation. This vulnerability affects Linux kernel versions containing the specified commit and is relevant to systems using the iocost controller for block device I/O management. No known exploits are reported in the wild as of the publication date.

For European organizations, the primary impact of CVE-2021-47584 is on system availability and stability. Systems running vulnerable Linux kernel versions with the iocost controller enabled may experience kernel crashes or panics under specific workloads involving cgroups with low active hweight donating I/O bandwidth. This can lead to unexpected downtime, disruption of critical services, and potential data loss if the crash occurs during I/O operations. Organizations relying on Linux servers for infrastructure, cloud services, or embedded systems could face operational interruptions. While this vulnerability does not directly compromise confidentiality or integrity, the availability impact can affect business continuity, especially for sectors with high uptime requirements such as finance, healthcare, telecommunications, and public services. The lack of known exploits reduces immediate risk, but the vulnerability should be addressed proactively to prevent potential exploitation or accidental triggering in production environments.

To mitigate CVE-2021-47584, European organizations should: 1) Apply the official Linux kernel patches that exclude cgroups with active hweight less than 2 from donation calculations. This fix is the definitive solution and prevents the divide-by-zero error. 2) If patching is not immediately possible, consider disabling or avoiding the use of the iocost controller in the Linux kernel configuration or cgroup setup, especially in environments where low hweight cgroups are used. 3) Monitor kernel logs for warnings related to iocost donation weights and divide-by-zero errors to detect potential triggering of this vulnerability. 4) Test kernel updates in staging environments to ensure stability before deployment, as kernel patches can affect system performance. 5) Maintain up-to-date Linux kernel versions from trusted sources and subscribe to vendor security advisories to receive timely updates. 6) Review cgroup configurations to avoid scenarios where cgroups have active hweight of 1 donating I/O bandwidth, reducing the chance of triggering the bug.