CVE-2021-47483

What it actually does

Double-free in Linux kernel regmap regcache_rbtree_exit when reallocation fails in regcache_rbtree_insert_to_block, leaving rbnode->block pointing to freed memory that is freed again on error path in regcache_rbtree_init.

Why it matters to the business

Kernel crashes or instability on Linux systems during certain hardware device initialization, leading to denial of service and potential local exploitation opportunities.

How an attack unfolds

An attacker triggers the regcache initialization error path by inducing memory allocation failure during regcache_rbtree_insert_to_block, causing the double-free which KASAN detects and may be leveraged for further memory corruption attacks.

How to fix it

Apply the upstream kernel fix that moves the rbnode->block assignment immediately after successful reallocation; update to patched kernel versions containing the regmap change.

How to confirm the fix worked

Inspect kernel source for regcache_rbtree_insert_to_block to confirm rbnode->block is assigned right after successful realloc before any subsequent operations, and verify absence of double-free KASAN reports on affected code paths.

Typical attack path

1. Initiate device probe or regmap initialization for affected hardware
2. Force reallocation failure inside regcache_rbtree_insert_to_block
3. Enter error handling in regcache_rbtree_init
4. Trigger second free of the same block in regcache_rbtree_exit

How to detect it

Scan kernel logs for KASAN double-free reports referencing kfree, regcache_rbtree_exit, or regcache_rbtree_init during device probe or regmap initialization sequences.

• BUG: KASAN: double-free or invalid-free in kfree
• regcache_rbtree_exit+0x15d
• regcache_rbtree_init+0x224
• regcache_init+0x88d

What your security team should do

• Prioritize kernel updates containing the regmap double-free fix
• Review systems for exposure during SPI or similar device probing
• Enable KASAN or similar memory debugging in test environments to validate