CVE-2021-47289

What it actually does

The vulnerability allows a NULL pointer to be passed to acpi_dev_put(), which internally calls put_device() with an invalid offset, resulting in a kernel NULL pointer dereference and potential memory corruption or system instability.

Why it matters to the business

Systems may experience unexpected crashes or kernel panics during ACPI device enumeration, leading to downtime, loss of availability, and possible data corruption on affected Linux deployments.

How an attack unfolds

An attacker with local access triggers ACPI device matching code paths that previously returned NULL, causing the buggy reference-counting helper to dereference the NULL pointer and crash the kernel.

How to fix it

Update the Linux kernel to a version containing the fix that makes acpi_dev_put() silently accept NULL pointers before calling put_device().

How to confirm the fix worked

Verify the presence of the upstream commit that adds NULL handling to acpi_dev_put() and confirm that ACPI device iteration no longer triggers NULL dereferences in testing.

Typical attack path

1. Obtain local execution on a Linux system
2. Trigger ACPI device enumeration or matching operations that return NULL from for_each_acpi_dev_match()
3. Cause acpi_dev_put() to be called on the NULL pointer
4. Trigger kernel panic or memory corruption via the resulting dereference

How to detect it

Inspect kernel logs for NULL pointer dereference oops messages originating from ACPI utility functions or put_device() calls during device matching; review audit logs for unusual local ACPI-related activity.

What your security team should do

• Apply the kernel update containing the NULL-safety fix for acpi_dev_put() as soon as it is available for the distribution in use
• Prioritize patching on systems that rely on ACPI device matching or enumeration
• Monitor for kernel oops or panic reports related to ACPI reference counting