CVE-2021-47525

What it actually does

Use-after-free and memory leak in the liteuart serial driver during driver unbind, caused by failing to deregister the serial port before releasing driver data allocated by the serial core.

Why it matters to the business

Local attackers can trigger kernel instability, crashes, or potential privilege escalation on affected Linux systems, leading to downtime, data loss, or full system compromise in environments relying on this serial hardware.

How an attack unfolds

An attacker with local access loads or unloads the liteuart driver (or triggers device unbind via sysfs or module removal) to cause the serial port to be accessed after its data structures have been freed, enabling memory corruption.

How to fix it

Update the Linux kernel to a version containing the fix that deregisters the serial port on unbind; apply vendor backports for supported distributions and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains the commit that calls uart_unregister_port during liteuart_remove; inspect dmesg or driver source for proper port deregistration on unbind and test module load/unload cycles.

Typical attack path

1. Obtain local user access on a Linux system using the liteuart driver
2. Trigger driver unbind or module removal through sysfs, udev events, or explicit rmmod
3. Exploit the freed port structure for arbitrary read/write or code execution in kernel context

How to detect it

Review kernel logs for use-after-free warnings or oops involving liteuart or uart_port structures during module unload; correlate with audit logs showing module removal or sysfs writes to unbind.

What your security team should do

• Prioritize kernel updates on systems exposing the liteuart driver
• Restrict local module loading and device unbind privileges where possible
• Monitor for kernel oops or use-after-free reports in serial subsystems