CVE-2021-47356

What it actually does

The vulnerability is a use-after-free in the mISDN driver's HFC_cleanup() because del_timer() returns without waiting for a pending timer handler to finish, allowing the handler to continue executing after module removal has freed associated structures.

Why it matters to the business

Systems using the affected kernel module can experience crashes, memory corruption, or denial of service, increasing operational risk and requiring urgent patching on any Linux deployments that load mISDN.

How an attack unfolds

An attacker with local access times the unloading of the mISDN module so that a scheduled timer handler is still running; after the remove path frees memory the handler accesses the freed object, resulting in a use-after-free.

How to fix it

Apply the upstream fix that replaces del_timer() with del_timer_sync() in the HFC_cleanup path; rebuild and deploy the patched kernel. Monitor vendor advisories for distribution backports.

How to confirm the fix worked

Confirm the source contains del_timer_sync() in the relevant cleanup function and verify the running kernel was built from the patched tree; re-test module load/unload cycles under timer-active conditions.

Typical attack path

1. Obtain local access on a system with the mISDN HFC driver loaded
2. Trigger or wait for conditions that schedule a timer in HFC_cleanup context
3. Force module removal while the timer remains active
4. Allow the handler to execute after the backing memory has been released

How to detect it

Review kernel logs for oops or panic messages referencing mISDN or HFC structures around module unload events; inspect audit logs for unexpected mISDN module removal.

What your security team should do

• Prioritize patching any Linux kernels that include the mISDN HFC driver
• Audit systems for mISDN usage and disable the module if not required
• Add kernel module loading events to monitoring for anomalous mISDN activity