CVE-2021-47210

What it actually does

The flaw is an improper input validation check in tps6598x_block_read that triggers a WARN_ON (potentially causing kernel panic when panic-on-warn is enabled) instead of gracefully returning an error for oversized length parameters.

Why it matters to the business

Systems configured with panic-on-warn may experience unexpected kernel crashes or reboots when handling certain USB Type-C controller inputs, leading to availability loss in affected Linux environments.

How an attack unfolds

An attacker supplies a USB Type-C device or emulated controller that invokes tps6598x_block_read with a length exceeding the allowed maximum; the kernel hits the WARN_ON, and if panic-on-warn is active the system crashes.

How to fix it

Update the Linux kernel to a version containing the fix that replaces the WARN_ON with a simple error return in tps6598x_block_read.

How to confirm the fix worked

Confirm the patch is present by inspecting the tps6598x_block_read function for removal of the WARN_ON call and replacement with an error return path; test with oversized length inputs to verify graceful error handling.

Typical attack path

1. Connect or present a malicious or malformed USB Type-C device to the target system
2. Trigger tps6598x_block_read with an oversized length value
3. Cause WARN_ON to fire, resulting in kernel panic on panic-on-warn configurations

How to detect it

Review kernel logs for WARN_ON or panic messages referencing tps6598x_block_read or tipd; correlate with USB device insertion events around the time of any crashes.

What your security team should do

• Apply the kernel patch or upgrade to a fixed release as soon as possible
• Audit systems for panic-on-warn configuration and consider disabling it if not required
• Monitor for USB Type-C related kernel oops or panic events