CVE-2021-47310

What it actually does

Use-after-free in the TI ThunderLAN network driver when private data is referenced after the net device has been freed during device removal.

Why it matters to the business

Potential kernel memory corruption on systems using the affected driver can lead to crashes, data loss, or local privilege escalation, disrupting network-dependent operations and requiring urgent patching on affected Linux deployments.

How an attack unfolds

An attacker with local access triggers the driver's removal path (e.g., via module unload or hot-unplug) so that subsequent use of already-freed private data causes a use-after-free that can be leveraged for arbitrary memory writes or code execution.

How to fix it

Update to a Linux kernel containing the fix that moves free_netdev() to the end of tlan_remove_one; apply the latest stable kernel for the distribution in use.

How to confirm the fix worked

Confirm the kernel source contains the corrected ordering of free_netdev() after all uses of priv; verify the running kernel version includes the upstream commit resolving the UAF.

Typical attack path

1. Obtain local access on a system with the vulnerable TI ThunderLAN driver loaded
2. Trigger net device removal to invoke tlan_remove_one
3. Arrange for the freed private data pointer to be reused for memory corruption
4. Escalate to kernel-level code execution or denial of service

How to detect it

Review kernel logs and dmesg for use-after-free warnings or crashes referencing tlan_remove_one or netdev private data; inspect module load/unload events around network device removal.

What your security team should do

• Prioritize kernel updates on any systems exposing the TI ThunderLAN driver
• Audit for legacy network hardware still using the tlan driver and plan hardware refresh
• Monitor kernel crash logs for UAF signatures involving netdev private data
• Apply defense-in-depth with kernel hardening features such as KASAN or hardened allocators where available