LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47229: PCI: aardvark: Fix kernel panic during PIO transfer

In the Linux kernel, the following vulnerability has been resolved: PCI: aardvark: Fix kernel panic during PIO transfer Trying to start a new PIO transfer by writing value 0 in PIO_START register when previous transfer has not yet completed (which is indicated by value 1 in PIO_START) causes an External Abort on CPU, which results in kernel panic: SError Interrupt on CPU0, code 0xbf000002 -- SError Kernel panic - not syncing: Asynchronous SError Interrupt To prevent kernel panic, it is required to reject a new PIO transfer when previous one has not finished yet. If previous PIO transfer is not finished yet, the kernel may issue a new PIO request only if the previous PIO transfer timed out. In the past the root cause of this issue was incorrectly identified (as it often happens during link retraining or after link down event) and special hack was implemented in Trusted Firmware to catch all SError events in EL3, to ignore errors with code 0xbf000002 and not forwarding any other errors to kernel and instead throw panic from EL3 Trusted Firmware handler. Links to discussion and patches about this issue: https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=3c7dcdac5c50 https://lore.kernel.org/linux-pci/20190316161243.29517-1-repk@triplefau.lt/ https://lore.kernel.org/linux-pci/971be151d24312cc533989a64bd454b4@www.loen.fr/ https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/1541 But the real cause was the fact that during link retraining or after link down event the PIO transfer may take longer time, up to the 1.44s until it times out. This increased probability that a new PIO transfer would be issued by kernel while previous one has not finished yet. After applying this change into the kernel, it is possible to revert the mentioned TF-A hack and SError events do not have to be caught in TF-A EL3.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash affected systems during certain PCIe controller activity. It is mainly an availability risk: a vulnerable device may panic instead of handling a delayed PIO transfer safely. The source bundle does not show active exploitation, CVSS scoring, or broad product impact beyond Linux kernels using the aardvark PCI controller path.

Executive priority

Treat this as a targeted availability issue. It deserves prompt patching on affected appliances or embedded Linux systems, but the provided evidence does not support emergency enterprise-wide response absent matching hardware and kernel exposure.

Technical view

The PCI aardvark driver could start a new PIO transfer while a prior transfer was still active, causing an External Abort and kernel panic. The fix rejects new PIO transfers unless the previous one completed or timed out. The issue is associated with link retraining or link-down conditions that lengthen transfer completion time.

Likely exposure

Exposure is likely limited to Linux systems with affected kernel versions and PCI aardvark controller usage. The bundle lists affected Linux versions from 4.8 through 5.13-era stable releases, with fixes represented by upstream stable commits.

Exploitation context

No CISA KEV listing or cited source in the bundle supports active exploitation. The described failure occurs when kernel PIO transfer timing overlaps during PCI link instability, producing a denial-of-service style kernel panic rather than a documented remote compromise path.

Researcher notes

The key root cause is unsafe overlap of aardvark PIO transfers. Earlier Trusted Firmware-A handling reportedly masked SError behavior, but the kernel-side fix addresses the driver condition directly. Affected-product precision depends on confirming hardware, kernel branch, and downstream vendor backports.

Mitigation direction

  • Update affected Linux kernels to builds containing the referenced stable fixes.
  • Check distribution vendor advisories for the exact fixed package version.
  • Prioritize embedded or appliance systems using PCI aardvark hardware.
  • Avoid relying on firmware-level SError masking as the primary correction.
  • Plan maintenance windows because remediation requires kernel replacement or reboot.

Validation and detection

  • Inventory systems for affected Linux kernel versions and aardvark PCI controller usage.
  • Confirm the running kernel includes one of the referenced stable fixes.
  • Review kernel logs for SError Interrupt code 0xbf000002 panics.
  • Check for PCI link retraining or link-down events before crashes.
  • Validate vendor release notes before marking systems remediated.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47229 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8c39d710363c14ecb09219332869707395d1d495, 8c39d710363c14ecb09219332869707395d1d495, 8c39d710363c14ecb09219332869707395d1d495, 8c39d710363c14ecb09219332869707395d1d495, 8c39d710363c14ecb09219332869707395d1d495, 8c39d710363c14ecb09219332869707395d1d495unaffected
LinuxLinux4.8, 0, 4.14.240, 4.19.198, 5.4.128, 5.10.46, 5.12.13, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.