CVE-2021-47278

What it actually does

The driver's remove path uses del_timer() rather than del_timer_sync(), allowing a pending timer handler to continue executing after mhi_pci_remove() has returned and freed associated structures, resulting in a classic use-after-free in kernel memory.

Why it matters to the business

Systems running affected kernels may experience crashes, memory corruption, or local privilege escalation when the MHI PCI device is removed or the module unloaded, increasing downtime risk and potential for kernel-level compromise on servers or embedded devices.

How an attack unfolds

An attacker with local access triggers repeated attach/detach cycles or module unload on an MHI PCI device while a timer remains armed; the handler then dereferences already-freed memory, enabling memory corruption that can be turned into arbitrary kernel code execution.

How to fix it

Rebuild or upgrade the kernel so that mhi_pci_remove() calls del_timer_sync() instead of del_timer(); apply any vendor back-ports that synchronize timer deletion in the MHI PCI generic driver.

How to confirm the fix worked

Inspect the mhi_pci_remove() implementation in the running kernel source or via objdump to confirm del_timer_sync() is present; verify the change appears in the applied patch series.

Typical attack path

1. Obtain local access on a system exposing the MHI PCI device
2. Rapidly attach/detach the device or unload the pci_generic module
3. Leave a timer scheduled so del_timer() returns before the handler runs
4. Handler accesses freed objects leading to UAF and privilege escalation

How to detect it

Review kernel logs for oops/panic traces referencing mhi_pci or timer handlers after device removal events; correlate with audit logs showing module unload or PCI hotplug activity around the same time.

What your security team should do

• Prioritize kernel updates containing the del_timer_sync fix on all systems exposing MHI PCI hardware
• Restrict unprivileged module loading and device attach/detach operations until patched
• Include the driver in automated kernel patch testing and reboot validation pipelines