CVE-2021-47224

What it actually does

Use-after-free in the ll_temac driver where the skb is freed on the first TX BD of a multi-fragment packet while later BDs are still being processed by DMA, allowing subsequent DMA accesses to freed memory.

Why it matters to the business

Kernel memory corruption or crashes on systems using the ll_temac Ethernet driver, potentially enabling remote code execution or denial of service with minimal attacker effort.

How an attack unfolds

An attacker sends network frames that require multiple transmit buffer descriptors; when the first BD completes, the driver frees the skb while remaining BDs are still active, leading to DMA use-after-free that can be leveraged for memory manipulation.

How to fix it

Update the Linux kernel to a version containing the fix that moves the skb pointer to the final TX BD so the buffer is freed only after all fragments are transmitted.

How to confirm the fix worked

Inspect the ll_temac transmit-done path in the running kernel source or binary to confirm skb release occurs only on the last BD; test with multi-fragment TX workloads and verify absence of use-after-free warnings under memory debugging.

Typical attack path

1. Send network traffic that triggers multi-BD transmission in ll_temac
2. Force early completion notification on the first BD
3. Access the now-freed skb region via in-flight DMA operations

How to detect it

Search kernel logs for ll_temac-related oops, DMA faults, or use-after-free warnings; correlate with network interface activity and transmit completion events.

What your security team should do

• Prioritize kernel updates on any system exposing the ll_temac driver
• Disable the driver via module blacklist if the hardware is not required
• Enable kernel memory debugging (KASAN/KMSAN) on test systems to surface latent UAFs