CVE-2021-47031

What it actually does

The vulnerability is a memory leak in the mt7921_coredump_work function of the mt76 wireless driver that fails to release allocated buffers after coredump processing completes.

Why it matters to the business

Affected Linux systems with mt7921 hardware may suffer gradual memory exhaustion, leading to performance degradation, service disruptions, or crashes that increase operational maintenance costs over time.

How an attack unfolds

An attacker triggers repeated coredump operations on the wireless device through normal or crafted wireless activity, causing the kernel to allocate memory without freeing it until system resources are depleted.

How to fix it

Upgrade the linux package to the fixed versions: 6.1.94-1 or later on Debian 12 and 6.8.12-1 or later on Debian 13. Reboot systems after applying the kernel update.

How to confirm the fix worked

Confirm the installed kernel version matches or exceeds the listed fixed releases and verify the mt7921_coredump_work function contains the leak fix by inspecting source or changelog entries.

Typical attack path

1. Identify hosts running vulnerable kernel versions with mt7921 hardware
2. Trigger conditions that invoke mt7921_coredump_work (e.g., firmware crashes or error paths)
3. Repeat the triggering activity to accumulate leaked memory
4. Observe system instability or OOM conditions

How to detect it

Examine kernel logs for repeated mt7921 coredump entries and track system memory statistics for unexplained growth not attributable to normal workloads.

What your security team should do

• Apply the kernel updates immediately on all Debian 12/13 systems with mt7921 hardware due to the memory corruption family
• Monitor memory utilization trends on affected hosts until patches are deployed
• Test kernel upgrades in a non-production environment before broad rollout