CVE-2021-47518

What it actually does

Potential NULL pointer dereference in the nfc_genl_dump_ses_done() netlink done callback when nfc_genl_dump_ses() allocation fails, resulting in kernel oops or panic on local invocation of NFC session dump operations.

Why it matters to the business

Local denial-of-service against Linux systems using NFC, causing unplanned reboots or service disruption; high availability impact with low attacker effort but limited to local access.

How an attack unfolds

An attacker with local access triggers the NFC netlink dump interface; the dumpit function encounters an allocation failure and passes NULL to the done callback which lacks a NULL check, dereferencing the pointer and crashing the kernel.

How to fix it

Update the Linux kernel to a release containing the upstream fix for the NULL check in nfc_genl_dump_ses_done(); rebuild and reboot with the patched kernel; apply vendor backports where available for supported distributions.

How to confirm the fix worked

Verify the running kernel source contains the NULL guard in nfc_genl_dump_ses_done(); confirm via kernel version string or git commit history that the patch is present; test by exercising NFC netlink dump paths under memory pressure.

Typical attack path

1. Obtain local shell or process execution on target Linux host
2. Invoke netlink NFC session dump operation via nfc_genl
3. Force allocation failure inside nfc_genl_dump_ses()
4. Trigger nfc_genl_dump_ses_done() with NULL argument
5. Kernel dereferences NULL and panics or oops

How to detect it

Review kernel logs for oops or panic messages referencing nfc_genl_dump_ses_done or nfc_genl_dump_ses; correlate with local process execution around NFC netlink activity; examine audit logs for netlink socket usage by unprivileged users.

What your security team should do

• Prioritize kernel updates on systems exposing NFC interfaces or running NFC-enabled workloads
• Monitor upstream stable and distribution kernel changelogs for the fix
• Restrict local user access on multi-tenant systems until patched
• Include kernel NULL dereference crashes in crash-dump analysis pipelines