CVE-2021-47180

What it actually does

Memory leak occurs because nfcmrvl_disconnect does not free the hci_dev allocation inside struct nci_dev; the object remains referenced after nci_allocate_device succeeds but the device later disconnects.

Why it matters to the business

Systems using affected NFC hardware experience gradual kernel memory exhaustion that can eventually trigger out-of-memory conditions, reduced stability, or forced reboots, especially on long-running embedded or server platforms with repeated device attach/detach cycles.

How an attack unfolds

An attacker with local access repeatedly inserts or enumerates a supported Marvell NFC USB device; each probe path allocates hci_dev via nci_hci_allocate but the corresponding free is never reached on disconnect, accumulating unreferenced 1024-byte objects until memory pressure occurs.

How to fix it

Update to a Linux kernel containing the fix that calls kfree on hci_dev inside nci_free_device; apply the stable backport or mainline commit that resolves the leak in net/nfc/nci/hci.c and core.c.

How to confirm the fix worked

After patching, reproduce the nfcmrvl_probe and disconnect sequence while monitoring /proc/meminfo or kmemleak for the previously reported 1024-byte unreferenced object; confirm the allocation backtrace no longer appears.

Typical attack path

1. Obtain local shell or physical USB access on target system
2. Trigger repeated USB attach/detach of nfcmrvl-compatible NFC hardware
3. Allow kernel worker threads to execute nci_allocate_device without subsequent nci_free_device cleanup
4. Observe progressive kernel memory consumption until OOM killer or system instability

How to detect it

Inspect dmesg and kmemleak reports for unreferenced objects allocated from nci_hci_allocate or kzalloc in net/nfc/nci/hci.c during USB probe of nfcmrvl devices; correlate with usb_device_add events and worker threads performing nci_allocate_device.

What your security team should do

• Prioritize kernel updates on any host exposing NFC USB interfaces or running Marvell NFC drivers
• Disable the nfcmrvl module via modprobe blacklist if NFC is unused
• Monitor kernel logs for memory-leak signatures during device enumeration
• Include the updated kernel in the next maintenance window given the 939-day disclosure gap