CVE-2021-47283

What it actually does

The SFC driver fails to set the irqs_hooked flag during initialization when configured for legacy IRQ mode, so the interrupt is never released on module removal, leaving a non-empty proc directory and leaking IRQ descriptors.

Why it matters to the business

Driver unload on systems using legacy interrupts produces kernel warnings and incomplete resource cleanup, which can complicate maintenance, logging, or automated module management in affected environments.

How an attack unfolds

An attacker with local access to load or unload the SFC module in legacy IRQ configuration triggers the missing flag path, causing the kernel to warn and leak IRQ resources during pci_disable_device and driver detach; no remote or unauthenticated path exists.

How to fix it

Update the Linux kernel to a version containing the fix that sets irqs_hooked during legacy IRQ initialization for the SFC driver; rebuild and reinstall the sfc module if using out-of-tree drivers.

How to confirm the fix worked

Reproduce module removal under legacy IRQ, confirm absence of remove_proc_entry warnings, and inspect driver initialization code for irqs_hooked assignment before free_irq calls.

Typical attack path

1. Obtain local access to the system
2. Ensure SFC driver is bound with legacy IRQ via modparam
3. Trigger module removal or driver detach
4. Observe remove_proc_entry warning and leaked IRQ descriptor

How to detect it

Search kernel logs and dmesg for remove_proc_entry warnings mentioning irq directories and the SFC PCI device during module unload or pci_device_remove events.

• remove_proc_entry: removing non-empty directory 'irq/
• WARNING: CPU:.*at fs/proc/generic.c.*remove_proc_entry
• efx_pci_remove.*[sfc]
• unregister_irq_proc

What your security team should do

• Prioritize kernel updates on systems using the SFC driver with legacy interrupts
• Prefer MSI-X or MSI interrupt modes where hardware permits
• Monitor kernel logs for remove_proc_entry warnings during driver unload