CVE-2021-47311

What it actually does

Use-after-free in emac_remove where the netdev private adapter structure is dereferenced after free_netdev has released it.

Why it matters to the business

Kernel memory corruption on systems using the Qualcomm EMAC driver can cause crashes, denial of service, or local privilege escalation during device removal or driver unload.

How an attack unfolds

An attacker with local access triggers emac device removal (module unload, hot-unplug, or interface teardown), causing the remove handler to access the already-freed adapter structure and enabling memory corruption primitives.

How to fix it

Apply a kernel update containing the fix that moves free_netdev to the end of emac_remove; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Inspect the emac_remove function in the running kernel source or object to confirm free_netdev is the final operation before return.

Typical attack path

1. Obtain local access on a system with the qcom/emac driver loaded
2. Trigger net device removal or module unload path
3. Force execution of emac_remove after free_netdev has run
4. Leverage the resulting UAF for arbitrary read/write or control-flow hijack

How to detect it

Search kernel logs and crash dumps for oops/panic messages referencing emac_remove, free_netdev, or use-after-free patterns on net device removal; correlate with module unload or interface down events.

What your security team should do

• Prioritize kernel updates on all systems exposing the qcom/emac driver
• Restrict local unprivileged access where possible until patched
• Monitor kernel logs for UAF or oops signatures during interface teardown