LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47047: spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails

In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails The spi controller supports 44-bit address space on AXI in DMA mode, so set dma_addr_t width to 44-bit to avoid using a swiotlb mapping. In addition, if dma_map_single fails, it should return immediately instead of continuing doing the DMA operation which bases on invalid address. This fixes the following crash which occurs in reading a big block from flash: [ 123.633577] zynqmp-qspi ff0f0000.spi: swiotlb buffer is full (sz: 4194304 bytes), total 32768 (slots), used 0 (slots) [ 123.644230] zynqmp-qspi ff0f0000.spi: ERR:rxdma:memory not mapped [ 123.784625] Unable to handle kernel paging request at virtual address 00000000003fffc0 [ 123.792536] Mem abort info: [ 123.795313] ESR = 0x96000145 [ 123.798351] EC = 0x25: DABT (current EL), IL = 32 bits [ 123.803655] SET = 0, FnV = 0 [ 123.806693] EA = 0, S1PTW = 0 [ 123.809818] Data abort info: [ 123.812683] ISV = 0, ISS = 0x00000145 [ 123.816503] CM = 1, WnR = 1 [ 123.819455] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000805047000 [ 123.825887] [00000000003fffc0] pgd=0000000803b45003, p4d=0000000803b45003, pud=0000000000000000 [ 123.834586] Internal error: Oops: 96000145 [#1] PREEMPT SMP

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash affected systems when the ZynqMP QSPI SPI driver continues a DMA flash read after memory mapping fails. The public record describes a kernel oops during a large flash read. Business impact is mainly reliability for exposed embedded or appliance systems, not proven remote compromise.

Executive priority

Treat this as a targeted reliability risk for embedded Linux platforms rather than an internet-wide emergency. Patch affected ZynqMP-based devices through normal maintenance unless they perform critical flash operations or have a history of related crashes.

Technical view

The spi-zynqmp-gqspi driver failed to stop when dma_map_single returned an error and used an invalid DMA address. The fix also sets a 44-bit DMA address width for the controller. The documented failure path involves large flash reads, swiotlb exhaustion, an unmapped DMA buffer, and a kernel paging fault.

Likely exposure

Exposure appears limited to Linux systems using the ZynqMP GQSPI/QSPI controller and affected kernel versions or unpatched vendor BSPs. General Linux servers without this driver and hardware path are unlikely to be exposed based on the provided sources.

Exploitation context

The sources do not report active exploitation, and the CVE is not listed as KEV. The record provides a crash scenario triggered by reading a large block from flash, but does not establish remote reachability, privilege requirements, or exploitability beyond denial of service.

Researcher notes

Key evidence is the upstream kernel resolution and crash trace. Missing data includes CVSS, CWE, affected distribution matrices, attacker prerequisites, and any proof of exploitation. Validate exposure through hardware, driver, and downstream kernel backport status, not package name alone.

Mitigation direction

  • Update to a kernel or vendor BSP containing the referenced stable fixes.
  • Confirm downstream vendor advisories for backported fixes in appliance images.
  • Prioritize systems where ZynqMP QSPI flash reads are operationally important.
  • Avoid repeated large flash-read workflows on affected systems until patched.
  • Monitor kernel logs for zynqmp-qspi DMA mapping errors.

Validation and detection

  • Inventory Linux kernel versions against the affected ranges in the CVE record.
  • Confirm whether systems use the spi-zynqmp-gqspi driver and ZynqMP QSPI hardware.
  • Verify the running kernel includes the referenced stable commit backport.
  • Review logs for swiotlb buffer full, rxdma memory not mapped, or kernel oops events.
  • Test patched images in staging with representative flash-read workloads.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47047 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1c26372e5aa9e53391a1f8fe0dc7cd93a7e5ba9e, 1c26372e5aa9e53391a1f8fe0dc7cd93a7e5ba9e, 1c26372e5aa9e53391a1f8fe0dc7cd93a7e5ba9e, 1c26372e5aa9e53391a1f8fe0dc7cd93a7e5ba9eunaffected
LinuxLinux5.10, 0, 5.10.37, 5.11.21, 5.12.4, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.