CVE-2021-47174: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability was discovered in the netfilter component, specifically in the nft_set_pipapo_avx2 functionality. The issue involves improper handling of FPU (Floating Point Unit) operations when running from a softirq that interrupted a kthread also using the FPU. This vulnerability has been assigned CVE-2021-47174 and was resolved by adding an irq_fpu_usable() check with a fallback to non-AVX2 version (Kernel Commit).

The vulnerability occurs when nft_pipapo_avx2_lookup() attempts to use the FPU while running from a softirq that interrupted a kthread that was also using the FPU. This creates a potential race condition in the FPU state management. The issue was fixed by implementing a check using irq_fpu_usable() and providing a fallback mechanism to the non-AVX2 version (nft_pipapo_lookup()) when the FPU cannot be safely used (Kernel Commit).

When triggered, this vulnerability results in a kernel warning and potential system instability. The issue affects systems running the Linux kernel with the netfilter subsystem enabled and using AVX2 instructions for packet filtering operations (NVD).

The vulnerability requires specific conditions to be triggered, specifically when the system is processing network packets using netfilter rules while simultaneously handling FPU operations in different contexts. There are no known public exploits targeting this vulnerability (NVD).

The vulnerability has been fixed in the Linux kernel by adding proper FPU usage checks and implementing a fallback mechanism. The fix involves checking irq_fpu_usable() before performing AVX2 operations and falling back to the non-AVX2 version when necessary. Users should update their kernel to a version containing the fix (Kernel Commit).