CVE-2021-47022

What it actually does

Incorrect ordering of mt7615_tx_token_put before mt76_free_pending_txwi in mt7615_unregister_device allows transmit tokens to remain allocated, causing a memory leak on device teardown.

Why it matters to the business

Wireless-enabled Linux systems may experience gradual memory exhaustion during repeated device registration cycles, resulting in performance degradation or eventual instability after prolonged operation.

How an attack unfolds

An attacker triggers repeated registration and unregistration of the mt7615 wireless device through module reloads or hardware events to accelerate token leakage until system memory is depleted.

How to fix it

Update the Linux kernel to a version that includes the corrected call order ensuring mt7615_tx_token_put executes before mt76_free_pending_txwi during unregister.

How to confirm the fix worked

Inspect the mt7615_unregister_device implementation in the mt76 driver source to confirm mt7615_tx_token_put precedes mt76_free_pending_txwi, then test repeated register/unregister cycles while monitoring memory usage.

Typical attack path

1. Locate Linux system using mt76 mt7615 wireless hardware
2. Cause repeated device unregistration events
3. Observe increasing memory consumption without corresponding frees

How to detect it

Examine kernel logs and dmesg output around device unregister events for allocation patterns without corresponding frees; use memory leak detection tools such as kmemleak on mt76 driver code paths.

What your security team should do

• Apply the kernel fix containing the memory leak resolution
• Monitor memory usage trends on systems with mt76 wireless drivers
• Restrict unprivileged module loading where feasible