CVE-2021-46990

MEDIUM
Published Feb 28, 2024 Modified Dec 26, 2024

Description

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix crashes when toggling entry flush barrier The entry flush mitigation can be enabled/disabled at runtime via a debugfs file (entry_flush), which causes the kernel to patch itself to enable/disable the relevant mitigations. However depending on which mitigation we're using, it may not be safe to do that patching while other CPUs are active. For example the following crash: sleeper[15639]: segfault (11) at c000000000004c20 nip c000000000004c20 lr c000000000004c20 Shows that we returned to userspace with a corrupted LR that points into the kernel, due to executing the partially patched call to the fallback entry flush (ie. we missed the LR restore). Fix it by doing the patching under stop machine. The CPUs that aren't doing the patching will be spinning in the core of the stop machine logic. That is currently sufficient for our purposes, because none of the patching we do is to that code or anywhere in the vicinity.

Is your site exposed to CVE-2021-46990?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor Product
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel

References

Advisories & Patches

https://git.kernel.org/stable/c/0b4eb172cc12dc102cd0ad013e53ee4463db9508 https://git.kernel.org/stable/c/0c25a7bb697f2e6ee65b6d63782f675bf129511a https://git.kernel.org/stable/c/2db22ba4e0e103f00e0512e0ecce36ac78c644f8 https://git.kernel.org/stable/c/5bc00fdda1e934c557351a9c751a205293e68cbf https://git.kernel.org/stable/c/8382b15864e5014261b4f36c2aa89723612ee058 https://git.kernel.org/stable/c/aec86b052df6541cc97c5fca44e5934cbea4963b https://git.kernel.org/stable/c/d2e3590ca39ccfd8a5a46d8c7f095cb6c7b9ae92 https://git.kernel.org/stable/c/dd0d6117052faace5440db20fc37175efe921c7d https://git.kernel.org/stable/c/ee4b7aab93c2631c3bb0753023c5dda592bb666b https://git.kernel.org/stable/c/0b4eb172cc12dc102cd0ad013e53ee4463db9508 https://git.kernel.org/stable/c/0c25a7bb697f2e6ee65b6d63782f675bf129511a https://git.kernel.org/stable/c/2db22ba4e0e103f00e0512e0ecce36ac78c644f8 https://git.kernel.org/stable/c/5bc00fdda1e934c557351a9c751a205293e68cbf https://git.kernel.org/stable/c/8382b15864e5014261b4f36c2aa89723612ee058 https://git.kernel.org/stable/c/aec86b052df6541cc97c5fca44e5934cbea4963b https://git.kernel.org/stable/c/d2e3590ca39ccfd8a5a46d8c7f095cb6c7b9ae92 https://git.kernel.org/stable/c/dd0d6117052faace5440db20fc37175efe921c7d https://git.kernel.org/stable/c/ee4b7aab93c2631c3bb0753023c5dda592bb666b

Frequently Asked Questions

What is CVE-2021-46990? +
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix crashes when toggling entry flush barrier The entry flush mitigation can be enabled/disabled at runtime via a debugfs file (entry_flush), which causes the kernel to patch itself to enable/disable the relevant mitigations. However depending on which mitigation we're using, it may not be safe to do that patching while other CPUs are active. For example the following crash: sleeper[15639]: segfault (11) at c000000000004c20 nip c000000000004c20 lr c000000000004c20 Shows that we returned to userspace with a corrupted LR that points into the kernel, due to executing the partially patched call to the fallback entry flush (ie. we missed the LR restore). Fix it by doing the patching under stop machine. The CPUs that aren't doing the patching will be spinning in the core of the stop machine logic. That is currently sufficient for our purposes, because none of the patching we do is to that code or anywhere in the vicinity. It has a CVSS v3.1 base score of 5.5 (MEDIUM).
How severe is CVE-2021-46990? +
CVE-2021-46990 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2021-46990? +
CVE-2021-46990 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2021-46990? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-9588 10.0

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. …
CVE-2025-57870 10.0

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This …
CVE-2026-48286 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result …
CVE-2026-13782 10.0

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer …
CVE-2026-48449 10.0

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the …
CVE-2026-48303 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2021-46990 — free, no signup required.