CVE-2021-47306

What it actually does

Use-after-free occurs when netdev private data pointer is dereferenced after free_netdev releases the structure during error handling in FDDI adapter probe.

Why it matters to the business

Kernel instability or crashes during network device initialization can interrupt connectivity on affected systems; low public exploitability reduces immediate operational risk but still requires patching for older Linux kernels.

How an attack unfolds

An attacker with local access triggers the error path in fza_probe so that the freed pointer is used after free_netdev, potentially leading to memory corruption or information disclosure.

How to fix it

Upgrade to a Linux kernel containing the fix that moves the free_netdev call after the error message print; apply the patch or newer kernel release that resolves the ordering issue in net/fddi/fza.c.

How to confirm the fix worked

Confirm the source change that reorders free_netdev after the error message; verify the running kernel version includes the corrected probe logic and test device initialization under error conditions.

Typical attack path

1. Obtain local execution on a system with an FDDI TURBOchannel adapter present
2. Force the probe routine into its error-handling branch
3. Trigger dereference of the now-freed private-data pointer
4. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for oops or panic messages referencing fza_probe or free_netdev around device initialization; examine audit logs for unexpected local processes attempting to load or probe FDDI modules.

What your security team should do

• Identify all systems running vulnerable kernel versions that include FDDI support
• Schedule kernel updates to a release containing the reordered free_netdev call
• Prioritize systems that still expose TURBOchannel or legacy FDDI hardware
• Monitor for any local privilege-escalation attempts while patches are applied