CVE-2021-47239

What it actually does

Use-after-free in smsc75xx_bind where a work item scheduled via smsc75xx_reset->smsc75xx_set_multicast can execute after the netdev private data has been freed because cancel_work_sync is missing and a dangling pointer remains in dev->data[0].

Why it matters to the business

Linux systems using SMSC75xx USB Ethernet adapters face risk of kernel crashes or local privilege escalation, potentially leading to downtime or full host compromise on affected hardware.

How an attack unfolds

An attacker with local access triggers repeated bind/unbind cycles on an SMSC75xx device while multicast updates are pending, allowing the orphaned work to dereference freed memory after the previous commit's incomplete cleanup.

How to fix it

Apply the upstream fix that inserts cancel_work_sync on the reset work item and clears the dangling dev->data[0] pointer before returning from smsc75xx_bind; rebuild and boot the patched kernel.

How to confirm the fix worked

Inspect the smsc75xx.c source for the cancel_work_sync call and NULL assignment in the bind routine; confirm the change appears after commit 46a8b29c6306 and test device attach/detach under load.

Typical attack path

1. Attach SMSC75xx USB Ethernet device
2. Configure multicast or trigger smsc75xx_set_multicast path
3. Initiate device removal or driver unbind to free the structure
4. Permit the scheduled work to run after deallocation

How to detect it

Review dmesg, journalctl, or /var/log/kern.log for use-after-free or general protection fault messages that reference smsc75xx_bind, smsc75xx_reset, or the workqueue function; correlate with USB device attach events.

What your security team should do

• Update to a kernel containing the referenced fix as soon as possible
• Restrict unprivileged USB device access via udev or physical controls
• Monitor kernel logs for smsc75xx-related oops or slab-use-after-free warnings