CVE-2021-47596

What it actually does

Use-after-free in the hns3 VF mailbox messaging path: the netdevice is released during client instance teardown but the acceleration engine uninstall path still dereferences it to log runtime state, allowing kernel memory corruption.

Why it matters to the business

Systems using Huawei hns3 network adapters may experience kernel crashes, denial of service, or potential local privilege escalation; older unpatched kernels remain exposed with no downstream package count data available.

How an attack unfolds

An attacker with local access triggers the driver's remove path (module unload or device hot-unplug) so that client teardown frees the netdevice while the acceleration engine code path still walks it, resulting in a use-after-free that can be leveraged for memory corruption.

How to fix it

Update to a kernel containing the fix that checks instance register state before accessing the netdevice during acceleration engine teardown; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the presence of the instance-state check in hclgevf_send_mbx_msg and verify that hns3_remove no longer performs the unsafe netdevice access after client removal.

Typical attack path

1. Obtain local access on a system with the vulnerable hns3 driver loaded
2. Trigger device removal or driver unload sequence
3. Force the race between client instance teardown and acceleration engine cleanup
4. Exploit the resulting use-after-free for memory corruption or code execution

How to detect it

Review kernel logs for use-after-free warnings, oops traces, or panics mentioning hclgevf_send_mbx_msg or hns3 during module unload or device removal events; inspect dmesg and journalctl for netdevice dereference after free patterns.

What your security team should do

• Apply the upstream fix or vendor kernel update immediately on all affected systems
• Prioritize systems exposing hns3 VF devices to local users
• Monitor for kernel oops or panic logs referencing hclgevf or hns3 during device removal