CVE-2021-47279

What it actually does

Null pointer dereference in the brcmstb-usb-pinmap USB driver when platform_get_resource() returns NULL without a subsequent check, causing a crash in the Linux kernel memory management path.

Why it matters to the business

Potential system instability or denial of service on Linux hosts using Broadcom STB USB hardware, leading to unplanned reboots and service interruptions; low urgency given age and minimal exploitability signals.

How an attack unfolds

An attacker with local access crafts conditions that cause the platform resource lookup to fail (for example via malformed device tree entries or hardware configuration), triggering the unchecked NULL return and resulting kernel panic.

How to fix it

Update the Linux kernel to a version containing the upstream fix that adds the missing NULL check after platform_get_resource(); rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Inspect the brcmstb-usb-pinmap source for an explicit NULL return check after platform_get_resource(); boot test the driver under resource-allocation failure conditions to confirm absence of dereference.

Typical attack path

1. Gain local code execution on a vulnerable Linux kernel
2. Trigger the brcmstb-usb-pinmap driver initialization or probe path
3. Force platform_get_resource() to return NULL
4. Execute the dereference of the NULL pointer to induce kernel crash

How to detect it

Review kernel logs for null-pointer dereference oops or panic messages containing brcmstb-usb-pinmap or platform_get_resource; correlate with USB device probe events.

What your security team should do

• Inventory Linux kernels and hardware using brcmstb-usb-pinmap
• Prioritize kernel upgrades on any production systems matching the driver
• Monitor for kernel oops reports referencing the driver
• Apply defense-in-depth by restricting local access where feasible