CVE-2021-47037

What it actually does

Use-after-free in the q6afe-clocks driver caused by hw.init being cleared on the first probe, resulting in a kernel oops when the driver is reprobed after APR service restart following a firmware crash.

Why it matters to the business

Kernel crashes or instability on Linux systems using affected Qualcomm audio subsystems, leading to audio failures, service disruption, and potential need for manual intervention or reboots.

How an attack unfolds

An attacker triggers an APR service restart (such as after forcing a firmware crash) to cause the q6afe-clocks driver to reprobe; the cleared hw.init then produces a use-after-free that panics the kernel.

How to fix it

Apply the upstream kernel patch that rewrites the driver to populate clock data at runtime instead of relying on a static array; update to a kernel release containing the fix for CVE-2021-47037.

How to confirm the fix worked

Confirm the driver source initializes clock data dynamically on each probe; reproduce APR restart scenarios in a test environment and verify absence of oops in dmesg.

Typical attack path

1. Trigger APR service restart or firmware crash condition
2. Force reprobe of the q6afe-clocks driver
3. Access the cleared hw.init structure causing use-after-free
4. Induce kernel oops or panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or panic messages referencing q6afe-clocks, ASoC, or hw.init during reprobe events; correlate with APR or firmware restart timestamps.

What your security team should do

• Prioritize kernel updates containing the q6afe-clocks fix on all affected systems
• Monitor kernel logs for ASoC or q6afe related oops during firmware or APR events
• Test audio subsystem stability after applying updates