CVE-2021-47064

What it actually does

Uninitialized skip_unmap field in mt76_dma_tx_queue_skb_raw can inherit nonzero stack garbage, preventing unmapping of DMA mappings for MCU command frames after completion and causing a resource leak.

Why it matters to the business

Systems using affected mt76 wireless drivers may experience gradual resource exhaustion, degraded performance, or instability under sustained MCU command traffic, increasing operational overhead for affected devices.

How an attack unfolds

An attacker with local access or the ability to trigger wireless MCU command paths supplies crafted skb data that leaves skip_unmap uninitialized; on completion the kernel skips the unmap, leaking DMA mappings until the system is restarted or resources are exhausted.

How to fix it

Update the Linux kernel to a version containing the mt76 DMA mapping fix; rebuild and redeploy any custom kernels or distributions that incorporate the mt76 driver.

How to confirm the fix worked

Confirm the presence of the upstream commit that initializes buf.skip_unmap before use in mt76_dma_tx_queue_skb_raw; inspect dmesg or driver logs for repeated DMA mapping warnings after applying the update.

Typical attack path

1. Obtain local execution or network-adjacent access to a device using the mt76 driver
2. Trigger repeated transmission of raw MCU command frames via the wireless stack
3. Cause the kernel to allocate DMA mappings while skip_unmap inherits a nonzero value from stack memory
4. Allow completion handlers to skip unmapping, accumulating leaked DMA resources

How to detect it

Review kernel logs and driver traces for repeated DMA mapping allocation without corresponding unmap events on mt76 devices; correlate with processes that generate raw MCU frames.

What your security team should do

• Prioritize kernel updates on all devices using mt76-based wireless hardware
• Monitor EPSS and exploit maturity indicators for any change in observed in-the-wild usage
• Restrict local user access on systems where wireless MCU paths can be triggered until patched