CVE-2021-47193

What it actually does

Failure to release allocated memory when the pm80xx SCSI driver module is unloaded, resulting in a memory leak.

Why it matters to the business

Repeated module load/unload operations on affected systems can gradually deplete available system memory, leading to performance degradation, instability, or the need for reboots in environments relying on this storage driver.

How an attack unfolds

An attacker with local privileges sufficient to manage kernel modules loads and unloads the pm80xx driver repeatedly, triggering incremental memory leaks that culminate in resource exhaustion and denial of service.

How to fix it

Upgrade the Linux kernel to a version that includes the fix ensuring all allocated memory is properly freed on pm80xx module removal.

How to confirm the fix worked

Confirm the running kernel incorporates the memory-freeing changes for the pm80xx driver on module exit; test by loading and unloading the module while monitoring kernel memory counters for leaks.

Typical attack path

1. Obtain local access with privileges to load and unload kernel modules
2. Ensure the pm80xx module is loaded
3. Unload the module using rmmod to trigger the leak
4. Repeat the load/unload cycle to accumulate leaked memory until system impact occurs

How to detect it

Track kernel memory allocation statistics before and after pm80xx module removal events; investigate unexplained growth in slab or kernel memory usage correlated with driver unload operations in system logs.

What your security team should do

• Apply kernel updates containing the pm80xx memory leak fix as soon as available for affected distributions
• Limit unprivileged module loading through kernel configuration or module signing enforcement
• Monitor memory usage trends on systems using pm80xx hardware during driver lifecycle events