CVE-2021-47494

What it actually does

Race condition in cfg80211 where the management registrations list is iterated without holding the required spinlocks on all wdev structures, resulting in list corruption.

Why it matters to the business

May cause kernel panics, system instability, or memory corruption on Linux devices using wireless networking, potentially disrupting operations or enabling local privilege escalation on affected hosts.

How an attack unfolds

An attacker with local access triggers concurrent management registration and update operations on a wireless device; the unsynchronized list iteration corrupts internal data structures, which can be leveraged for memory safety violations leading to denial of service or code execution.

How to fix it

Apply the upstream kernel patch that moves the lock to the wiphy/rdev level; rebuild and deploy updated kernels containing the fix for cfg80211 locking.

How to confirm the fix worked

Verify the presence of the locking change in cfg80211.c (wiphy/rdev lock protecting all registration lists) via source inspection or kernel version checks against the fixed commit.

Typical attack path

1. Obtain local access on a Linux system with wireless networking enabled
2. Trigger concurrent cfg80211 management registration and update paths
3. Exploit resulting list corruption to achieve memory corruption
4. Escalate to kernel code execution or cause denial of service

How to detect it

Inspect kernel logs for list corruption warnings, oops traces, or crashes involving cfg80211 management registration paths; correlate with wireless interface activity.

What your security team should do

• Prioritize kernel updates on all Linux systems exposing wireless interfaces
• Review wireless device usage and limit untrusted local access where feasible
• Monitor for kernel oops or list corruption warnings in system logs