CVE-2021-46979

What it actually does

Double removal of ioctl handlers during IIO device unregistration triggers a double-free condition in kernel memory management, resulting in kernel panic.

Why it matters to the business

Linux systems using IIO subsystems experience unexpected crashes and loss of device functionality, leading to operational downtime and potential data loss in affected environments.

How an attack unfolds

An attacker with local access triggers repeated IIO device registration and unregistration sequences to force the double-free path during cleanup routines.

How to fix it

Apply the upstream fix that removes direct ioctl handler list manipulation and ensures cleanup is performed only by the matching registration code; update to a kernel containing the resolution of this double-free issue.

How to confirm the fix worked

Confirm the kernel source includes the patch that eliminates direct ioctl handler removal in iio_device_unregister and delegates cleanup to iio_device_unregister_eventset and iio_buffers_free_sysfs_and_mask; test IIO device attach/detach cycles for stability.

Typical attack path

1. Obtain local code execution or shell access on a Linux host
2. Interact with IIO character devices to initiate device registration
3. Trigger unregistration paths that invoke both iio_device_unregister and subsequent event/buffer cleanup
4. Cause double-free and resulting kernel panic

How to detect it

Review kernel logs for double-free or panic messages during IIO device unregistration; examine audit logs for unusual patterns of IIO device open/close operations by non-standard processes.

What your security team should do

• Prioritize kernel updates on systems exposing IIO interfaces
• Monitor for kernel oops or panic logs related to IIO unregistration
• Restrict unprivileged access to /dev/iio* devices where possible