CVE-2021-47307

What it actually does

NULL pointer dereference in cifs_compose_mount_options() when an optional ref parameter supplies a NULL node_name, causing kernel crash during CIFS mount option composition.

Why it matters to the business

Unexpected system crashes or denial of service when mounting network file shares, disrupting file access and requiring reboots or manual intervention.

How an attack unfolds

An attacker supplies a crafted ref parameter containing a NULL node_name during CIFS mount operations, triggering the dereference inside the kernel module and resulting in a panic.

How to fix it

Update the Linux kernel to a version containing the upstream fix that guards the node_name dereference in cifs_compose_mount_options().

How to confirm the fix worked

Confirm the running kernel contains the commit that adds the NULL check before dereferencing node_name in cifs_compose_mount_options(); review kernel changelog or source for the guard.

Typical attack path

1. Locate a Linux system performing CIFS/SMB mounts
2. Craft a mount request or configuration supplying a ref parameter with NULL node_name
3. Trigger the mount composition function to execute the dereference
4. Observe kernel oops or system crash

How to detect it

Inspect kernel logs and dmesg output for oops or panic messages referencing cifs_compose_mount_options and NULL dereference; correlate with mount activity timestamps.

What your security team should do

• Apply the kernel patch or upgrade to a fixed release across all affected systems
• Test CIFS mount operations after update to verify stability
• Monitor kernel logs for oops entries referencing cifs_compose_mount_options