CVE-2021-47235

What it actually does

Use-after-free in ec_bhf_remove where netdev private data pointer is dereferenced for pci_iounmap after free_netdev has already released the structure.

Why it matters to the business

May cause kernel crashes or memory corruption on systems using the affected Ethernet driver, potentially leading to downtime or data loss during device removal operations.

How an attack unfolds

An attacker with local access triggers PCI device removal for the ec_bhf interface under race conditions that allow the freed priv pointer to be used, resulting in undefined kernel behavior; no public exploits or threat actor activity are known.

How to fix it

Apply the upstream kernel commit that reorders free_netdev after the pci_iounmap calls; rebuild and deploy updated kernels or distribution packages containing the fix.

How to confirm the fix worked

Inspect the ec_bhf_remove function in the running kernel source or binary to confirm free_netdev executes after both pci_iounmap operations; monitor for absence of use-after-free reports in kernel logs after device removal.

Typical attack path

1. Obtain local code execution on a Linux host using the ec_bhf driver
2. Trigger ec_bhf_remove via PCI hot-unplug or module unload
3. Exploit the window between free_netdev and subsequent pci_iounmap calls

How to detect it

Search kernel logs and crash dumps for references to ec_bhf_remove combined with use-after-free or slab freelist corruption messages; examine dmesg output around PCI device removal events.

What your security team should do

• Prioritize kernel updates on all systems exposing the ec_bhf driver
• Test device removal paths in staging environments before production rollout
• Review kernel configuration to disable unused Ethernet drivers where feasible