CVE-2021-47380

What it actually does

NULL pointer dereference in AMD SFH HID driver when devm_add_action_or_reset() invokes amd_mp2_pci_remove() before corresponding data structures are initialized during registration.

Why it matters to the business

System instability or crashes on affected AMD hardware running vulnerable kernels, potentially causing denial of service and operational downtime until patched kernels are deployed.

How an attack unfolds

An attacker triggers early driver probe or registration failure on AMD SFH-enabled systems, causing the remove callback to execute with uninitialized data and dereference a NULL pointer, leading to kernel panic.

How to fix it

Upgrade to a Linux kernel containing the fix that moves data initialization before the devm_add_action_or_reset() call in the amd_sfh driver.

How to confirm the fix worked

Inspect kernel source or changelog for the reordering of initialization ahead of devm_add_action_or_reset() in amd_sfh; verify no NULL dereference paths remain during probe on AMD SFH hardware.

Typical attack path

1. Load or probe the amd_sfh HID driver on vulnerable kernel
2. Force devm_add_action_or_reset() to invoke the registered remove handler prematurely
3. Trigger NULL dereference in uninitialized amd_mp2_pci_remove() path

How to detect it

Review kernel logs and oops reports for NULL pointer dereferences or panics involving amd_mp2_pci_remove or amd_sfh initialization sequences.

• amd_mp2_pci_remove
• NULL pointer dereference in amd_sfh

What your security team should do

• Prioritize kernel updates for systems with AMD SFH hardware
• Monitor boot and hardware probe logs for amd_sfh related panics
• Test driver initialization stability in lab environments before broad rollout