CVE-2021-47054

What it actually does

Reference count leak on device tree child nodes when breaking early from for_each_available_child_of_node() in the qcom bus driver, leaving nodes with elevated refcounts that are never released.

Why it matters to the business

Long-running Linux systems on affected Qualcomm platforms may gradually exhaust kernel memory, leading to instability, degraded performance, or eventual crashes that disrupt services.

How an attack unfolds

An attacker with the ability to influence device tree parsing or trigger the specific error path in the qcom bus code can cause repeated reference count leaks; over time the accumulated leaks exhaust memory resources without requiring direct code execution.

How to fix it

Apply the upstream fix that ensures of_node_put() is called before every early return inside the child node loop; rebuild and deploy the corrected kernel.

How to confirm the fix worked

Inspect the qcom bus source for the corrected pattern of of_node_put() before return statements inside for_each_available_child_of_node(); confirm the patch is present in the running kernel via source or binary diff.

Typical attack path

1. Gain local or remote access sufficient to trigger qcom bus device enumeration or error paths
2. Force repeated execution of the vulnerable loop exit condition
3. Accumulate unreleased node references until kernel memory pressure occurs
4. Induce system instability or denial of service

How to detect it

Review kernel logs for repeated device tree parsing warnings or out-of-memory events on qcom bus devices; correlate with process or module activity that exercises the affected driver paths.

What your security team should do

• Prioritize kernel updates on all Qualcomm-based Linux systems
• Monitor memory usage trends on affected devices for unexpected growth
• Apply the fix during the next scheduled maintenance window given the low EPSS and lack of KEV listing