CVE-2021-47415

What it actually does

The flaw is a missing NULL check on te_data->vif inside __iwl_mvm_remove_time_event() that allows a NULL pointer dereference in the iwlwifi mvm time-event handling path, resulting in a kernel oops or panic.

Why it matters to the business

Wireless-enabled Linux systems may experience sudden crashes or reboots when the driver removes time events under certain conditions, leading to loss of connectivity and unplanned downtime; the issue has been public for over two years with negligible exploitation probability.

How an attack unfolds

An attacker with local or wireless-adjacent access triggers removal of a time event while the vif pointer remains unset; the unchecked dereference causes an immediate kernel fault. No named threat actors or ransomware campaigns have been observed leveraging this path.

How to fix it

Upgrade to a Linux kernel containing commit that adds the NULL check in __iwl_mvm_remove_time_event(); apply the vendor-supplied update for the affected distribution as soon as possible.

How to confirm the fix worked

Verify the running kernel source contains the NULL check before the dereference of te_data->vif in __iwl_mvm_remove_time_event(); confirm the driver version matches a release after the fix was merged.

Typical attack path

1. Obtain local execution or position to influence 802.11 time-event state on an Intel wireless interface
2. Cause __iwl_mvm_remove_time_event() to be called with te_data->vif still NULL
3. Trigger the unconditional dereference, forcing a kernel NULL dereference fault

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for iwlwifi or mvm oops/panic messages referencing __iwl_mvm_remove_time_event or time-event removal; correlate with wireless interface activity preceding the crash.

• iwlwifi.*__iwl_mvm_remove_time_event
• NULL pointer dereference.*te_data
• mvm.*time event.*vif

What your security team should do

• Patch all affected systems to a kernel that includes the NULL check
• Monitor kernel logs for iwlwifi oops signatures until patching is complete
• Prioritize systems with Intel Wi-Fi hardware exposed to untrusted networks