CVE-2021-47405

What it actually does

The vulnerability is a memory leak in the usbhid driver where raw_report buffers allocated for HID reports are not freed when a USB device is removed via usbhid_stop.

Why it matters to the business

Repeated connection and removal of HID devices on Linux systems can cause gradual kernel memory exhaustion, leading to degraded performance, reduced availability, or eventual system instability over extended operation.

How an attack unfolds

An attacker with the ability to attach and detach USB HID devices triggers repeated allocations of raw_report buffers that are never released, allowing controlled accumulation of unreclaimed kernel memory until resource limits are reached.

How to fix it

Upgrade the Linux kernel to a version containing the fix that calls the appropriate free on raw_report buffers inside usbhid_stop.

How to confirm the fix worked

Confirm the presence of the buffer-freeing logic in usbhid_stop in the running kernel source or verify via kernel version comparison against the patch commit; test by exercising device removal and monitoring slab memory counters.

Typical attack path

1. Attach a USB HID device to the target system
2. Trigger usbhid initialization and report allocation
3. Remove the device to invoke usbhid_stop without freeing buffers
4. Repeat the attach/remove cycle to accumulate leaked memory

How to detect it

Monitor kernel slab allocators for growth in HID report structures correlated with USB device attach/detach events; review dmesg and slabinfo for unreclaimed buffers after device removal.

What your security team should do

• Prioritize kernel updates on systems that frequently handle USB HID devices
• Implement memory usage monitoring for HID-related slabs
• Restrict untrusted USB device attachment via policy or hardware controls