CVE-2021-47077

What it actually does

NULL pointer dereference in qedf_update_link_speed() when qedf_link_update() is invoked before shost_data initialization, causing kernel crash during link speed updates triggered from QED driver interrupt paths.

Why it matters to the business

Unexpected system crashes or reboots on Linux hosts using QLogic FastLinQ Ethernet and FCoE drivers, leading to unplanned downtime especially during hardware link events or early boot; low exploitation likelihood reduces immediate risk but still affects availability in storage and networking environments.

How an attack unfolds

An attacker with local access or ability to trigger hardware link changes induces the QED MCP event handler to call into qedf_link_update before the SCSI host data structure is ready, dereferencing a NULL shost_data pointer and crashing the kernel; no remote unauthenticated path exists and no named threat actors are associated.

How to fix it

Apply the upstream kernel patch adding the NULL pointer check in qedf_update_link_speed or upgrade to a fixed kernel release containing commit resolving CVE-2021-47077; prioritize in environments with QLogic/QED hardware.

How to confirm the fix worked

Verify kernel source contains the added pointer validation before shost_data dereference; confirm no matching oops traces appear in dmesg after link events; test on systems with qedf module loaded.

Typical attack path

1. Load or initialize qedf/qed modules on a vulnerable kernel
2. Trigger link state change events via hardware or QED MCP
3. qedf_link_update executes without initialized shost_data
4. NULL dereference occurs while accessing supported_speeds
5. Kernel panic or oops terminates the system

How to detect it

Search kernel logs and dmesg for the exact call trace involving qedf_link_update, qed_link_update, qed_mcp_handle_link_change and NULL dereference messages around IRQ or softirq contexts; correlate with qedf module load times.

• qedf_link_update+0x144/0x1f0 [qedf]
• qed_mcp_handle_link_change+0x2d2/0x410 [qed]
• shost_data is not initialised
• NULL pointer dereference when updating supported_speeds

What your security team should do

• Inventory Linux systems using qedf or qed drivers and schedule kernel updates
• Monitor for kernel panics matching the provided call trace
• Apply patches promptly on storage and SAN-connected hosts despite low EPSS
• Disable unused QEDF drivers where feasible to reduce attack surface