{"id":"DEBIAN-CVE-2021-46910","details":"In the Linux kernel, the following vulnerability has been resolved:  ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled  The debugging code for kmap_local() doubles the number of per-CPU fixmap slots allocated for kmap_local(), in order to use half of them as guard regions. This causes the fixmap region to grow downwards beyond the start of its reserved window if the supported number of CPUs is large, and collide with the newly added virtual DT mapping right below it, which is obviously not good.  One manifestation of this is EFI boot on a kernel built with NR_CPUS=32 and CONFIG_DEBUG_KMAP_LOCAL=y, which may pass the FDT in highmem, resulting in block entries below the fixmap region that the fixmap code misidentifies as fixmap table entries, and subsequently tries to dereference using a phys-to-virt translation that is only valid for lowmem. This results in a cryptic splat such as the one below.    ftrace: allocating 45548 entries in 89 pages   8\u003c--- cut here ---   Unable to handle kernel paging request at virtual address fc6006f0   pgd = (ptrval)   [fc6006f0] *pgd=80000040207003, *pmd=00000000   Internal error: Oops: a06 [#1] SMP ARM   Modules linked in:   CPU: 0 PID: 0 Comm: swapper Not tainted 5.11.0+ #382   Hardware name: Generic DT based system   PC is at cpu_ca15_set_pte_ext+0x24/0x30   LR is at __set_fixmap+0xe4/0x118   pc : [\u003cc041ac9c\u003e]    lr : [\u003cc04189d8\u003e]    psr: 400000d3   sp : c1601ed8  ip : 00400000  fp : 00800000   r10: 0000071f  r9 : 00421000  r8 : 00c00000   r7 : 00c00000  r6 : 0000071f  r5 : ffade000  r4 : 4040171f   r3 : 00c00000  r2 : 4040171f  r1 : c041ac78  r0 : fc6006f0   Flags: nZcv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment none   Control: 30c5387d  Table: 40203000  DAC: 00000001   Process swapper (pid: 0, stack limit = 0x(ptrval))  So let's limit CONFIG_NR_CPUS to 16 when CONFIG_DEBUG_KMAP_LOCAL=y. Also, fix the BUILD_BUG_ON() check that was supposed to catch this, by checking whether the region grows below the start address rather than above the end address.","modified":"2026-09-15T09:02:34.725353592Z","published":"2024-02-27T07:15:07.307Z","upstream":["CVE-2021-46910"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2021-46910"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-46910.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-46910.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-46910.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}