CVE-2021-46962

What it actually does

Missing tmio_mmc_host_free() call in the driver remove path after a corresponding tmio_mmc_host_alloc() in probe, resulting in a persistent memory leak for each load/unload cycle of the uniphier-sd MMC controller driver.

Why it matters to the business

Repeated module insertion or device hotplug events on affected Linux systems can slowly exhaust kernel memory, leading to degraded performance or eventual instability on servers and embedded devices that rely on this driver.

How an attack unfolds

An attacker with local access triggers repeated probe/remove cycles (via module unload, hotplug events, or crafted device attachment) to accumulate leaked host structures until memory pressure causes denial of service; no remote vector or named threat actors are associated with this issue.

How to fix it

Apply the upstream fix that adds the missing tmio_mmc_host_free() call in the remove function; upgrade to a Linux kernel containing commit resolving CVE-2021-46962.

How to confirm the fix worked

Inspect the remove function in drivers/mmc/host/uniphier-sd.c for presence of tmio_mmc_host_free() after the fix, or verify kernel version includes the patch; monitor for absence of memory growth during repeated module load/unload tests.

Typical attack path

1. Obtain local execution or module-loading privileges on target system
2. Repeatedly load/unload the uniphier-sd driver or simulate device removal events
3. Accumulate unreleased tmio_mmc_host allocations until kernel memory is exhausted

How to detect it

Review kernel logs for repeated uniphier-sd probe/remove sequences accompanied by rising slab or kmalloc memory usage; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on systems using uniphier-sd hardware
• Audit custom kernels or backports for the missing free call
• Limit unprivileged module loading where feasible