CVE-2021-47058

What it actually does

Use-after-free in Linux kernel regmap debugfs handling: debugfs_name is freed in regmap_debugfs_exit() during regmap_reinit_cache() but the subsequent regmap_debugfs_init() skips recreation due to an added if-condition, leaving a dangling pointer.

Why it matters to the business

Potential kernel crashes, memory corruption, or local privilege escalation on Linux systems; low exploit probability but high impact if triggered in production workloads or embedded devices.

How an attack unfolds

An attacker with local access triggers repeated regmap cache reinitialization (e.g., via device driver attach/detach sequences) to reuse the freed debugfs_name pointer for memory corruption or information disclosure.

How to fix it

Apply the upstream fix that sets debugfs_name to NULL after freeing in regmap_debugfs_exit(); update to a Linux kernel containing commit cffa4b2122f5 and the subsequent NULL assignment patch.

How to confirm the fix worked

Confirm the NULL assignment exists after the kfree of debugfs_name in regmap_debugfs_exit(); test by exercising regmap_reinit_cache() and verifying no memory leaks or use-after-free reports under kmemleak or KASAN.

Typical attack path

1. Obtain local code execution on a Linux host
2. Identify or trigger code paths calling regmap_reinit_cache()
3. Force regmap_debugfs_exit() to free debugfs_name
4. Reuse dangling pointer in regmap_debugfs_init() or related debugfs operations
5. Achieve memory corruption or kernel panic for denial-of-service or escalation

How to detect it

Review kernel logs for regmap debugfs warnings, use-after-free crashes, or KASAN reports involving debugfs_name; inspect call traces containing regmap_debugfs_exit and regmap_reinit_cache.

What your security team should do

• Prioritize kernel updates on systems exposing regmap (embedded, Android, servers)
• Monitor for local kernel exploits targeting regmap subsystems
• Enable KASAN or similar memory debugging in test environments to validate the fix