CVE-2021-47499

What it actually does

Memory leak occurs in kxcjk-1013 driver probe and remove when ACPI type is ACPI_SMO8500 because dready_trig is unset, leaving iio_triggered_buffer_setup allocations unfreed.

Why it matters to the business

Repeated driver load/unload cycles on affected Linux systems gradually exhaust memory, risking instability or forced reboots in embedded and sensor-equipped devices.

How an attack unfolds

An attacker with local access triggers repeated probe and remove operations on the accelerometer under the specific ACPI condition, causing the kernel to allocate buffers without releasing them and depleting available memory.

How to fix it

Upgrade to a Linux kernel containing the fix that removes the dready_trig condition check in probe and remove paths for the kxcjk-1013 driver.

How to confirm the fix worked

Confirm kernel source no longer contains the data->dready_trig guard around iio_triggered_buffer_setup calls; test probe/remove under ACPI_SMO8500 and verify no unreferenced kfifo allocations remain.

Typical attack path

1. Obtain local execution or hardware control on target system
2. Trigger device probe/remove sequences for kxcjk-1013 under ACPI_SMO8500
3. Repeat operations to accumulate unfreed allocations
4. Observe progressive memory exhaustion and system impact

How to detect it

Inspect kernel logs and memory traces for repeated iio_kfifo_allocate calls tied to i2c-SMO8500 processes without matching frees during device probe/remove cycles.

• i2c-SMO8500
• iio_kfifo_allocate
• iio_triggered_buffer_setup_ext

What your security team should do

• Apply the resolving kernel update as soon as available for the distribution
• Restrict unprivileged access to hardware or driver reload mechanisms
• Monitor kernel memory usage and iio_triggered_buffer allocations on sensor platforms