CVE-2021-47503

What it actually does

Premature call to scsi_remove_host() in pm8001_alloc() before scsi_add_host() has executed triggers a NULL pointer dereference inside device_del during pm8001_pci_probe of the pm80xx driver.

Why it matters to the business

Systems using the affected SCSI adapters may experience kernel crashes at boot or device insertion time, causing downtime, failed storage initialization, and potential data access loss until the system is recovered.

How an attack unfolds

An attacker with local access triggers the PCI probe path for a pm80xx device (via module load or hardware insertion), causing the erroneous scsi_remove_host call to execute and panic the kernel before the host is registered.

How to fix it

Update the Linux kernel to a version containing the fix that removes the scsi_remove_host call from pm8001_alloc; rebuild and deploy the corrected pm80xx driver module.

How to confirm the fix worked

Confirm the source tree no longer contains the scsi_remove_host call inside pm8001_alloc; boot with the pm80xx driver and verify successful scsi_add_host without a preceding remove or NULL dereference oops.

Typical attack path

1. Obtain local access or ability to load kernel modules
2. Trigger pm8001_pci_probe via device insertion or driver initialization
3. Execute pm8001_alloc which invokes scsi_remove_host prematurely
4. Induce kernel NULL pointer dereference and crash

How to detect it

Search kernel logs and crash dumps for the NULL pointer dereference in device_del, the scsi_remove_host backtrace, and the pm8001_pci_probe call site from the pm80xx module.

• BUG: kernel NULL pointer dereference, address: 0000000000000108
• RIP: 0010:device_del+0x63/0x440
• scsi_remove_host+0xee/0x2a0
• pm8001_pci_probe+0x6ef/0x1b90 [pm80xx]
• pm8001_alloc

What your security team should do

• Prioritize kernel updates on systems exposing the pm80xx driver
• Add kernel panic and oops monitoring for device_del and scsi_remove_host symbols
• Restrict unprivileged module loading where possible until patched