CVE-2021-47091

What it actually does

Missing acquisition of local->mtx mutex before releasing channel context in the ieee80211_start_ap error path, violating an asserted lock requirement and enabling a race condition in mac80211 wireless state management.

Why it matters to the business

Wireless access point initialization on affected Linux systems may trigger kernel instability or crashes, disrupting network services and requiring reboots that interrupt operations.

How an attack unfolds

An attacker with local access or control over wireless configuration triggers the error path during AP start, racing the unlocked channel context release to corrupt internal state or induce a denial of service.

How to fix it

Update to a Linux kernel version containing the fix that acquires local->mtx before releasing the channel context in the ieee80211_start_ap error path.

How to confirm the fix worked

Confirm the presence of the locking change around channel context release in the mac80211 ieee80211_start_ap function and verify no lockdep warnings occur during AP start error scenarios.

Typical attack path

1. Obtain local access or ability to invoke wireless AP configuration on target system
2. Issue commands or trigger conditions that cause ieee80211_start_ap to enter its error path
3. Race the unlocked channel context release to induce kernel panic or state corruption

How to detect it

Review kernel logs for oops, warnings, or lockdep assertions referencing ieee80211_start_ap or channel context release during wireless AP initialization attempts.

What your security team should do

• Prioritize kernel updates for systems using mac80211 wireless AP functionality
• Monitor for kernel oops or panics during wireless configuration changes
• Restrict local access to wireless configuration interfaces until patched