CVE-2021-47439

What it actually does

Race condition during DSA microchip driver removal causes cancel_delayed_work_sync to race with ksz_mac_link_down rescheduling mib_read_work; the work then dereferences dp->slave after the slave has been unregistered, producing a null pointer dereference.

Why it matters to the business

Kernel panic on module unload disrupts network services and forces reboots on any system using the ksz DSA driver; the issue is triggered only during rmmod and has seen no public exploitation, limiting operational blast radius but still requiring kernel updates on affected distributions.

How an attack unfolds

A local attacker loads the ksz module then issues rmmod; the removal path resets nothing, so ksz_mac_link_down reschedules the MIB work after dsa_unregister_switch has torn down the slave, and the delayed work crashes when it touches the now-null dp->slave pointer.

How to fix it

Update to a Linux kernel containing the fix that sets mib_interval to zero before calling cancel_delayed_work_sync inside ksz_switch_remove; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Inspect the ksz_switch_remove function in the running kernel source or debug symbols to confirm mib_interval is cleared prior to the cancel_delayed_work_sync call; attempt module unload in a test environment and verify absence of the null dereference oops.

Typical attack path

1. Obtain local shell or equivalent privileges on a Linux host
2. Ensure the ksz DSA module is loaded
3. Execute rmmod ksz (or equivalent) to trigger the removal race
4. Observe kernel panic from null dereference in the rescheduled work

How to detect it

Search kernel logs and vmcore for oops/panic strings containing ksz_mib_read_work, ksz_mac_link_down, or null pointer dereference during module unload sequences; correlate with audit logs showing rmmod of the ksz module.

What your security team should do

• Prioritize kernel package updates on all systems shipping the ksz DSA driver
• Restrict unprivileged module loading via modules_disabled or LSM policy
• Add kernel oops monitoring for ksz_mib_read_work symbols to detect accidental triggers