CVE-2021-47022: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47022 is a memory leak vulnerability in the Linux kernel's mt76 wireless driver, specifically affecting the mt7615 device unregistration process. The vulnerability was discovered in early 2021 and affects Linux kernel versions from 5.10.21 through 5.10.37, 5.11.4 through 5.11.21, and 5.12 through 5.12.4 (NVD).

The vulnerability occurs in the mt7615_unregister_device() function where mt7615_tx_token_put() was called after mt76_free_pending_txwi(), leading to a memory leak. The issue was introduced by commit a6275e934605 which implemented token reset functionality during mac_reset operations. The vulnerability has a CVSS v3.1 Base Score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability results in a memory leak during device unregistration, which could lead to resource exhaustion over time. While the impact is limited to local systems and requires local user privileges to exploit, it could potentially affect system stability through memory resource depletion (NVD).

The vulnerability requires local access and low privileges to exploit. It is triggered during the device unregistration process of the mt7615 wireless driver. No known active exploits have been reported in the wild (NVD).

The vulnerability has been fixed in the Linux kernel through a patch that corrects the order of operations in mt7615_unregister_device(), ensuring mt7615_tx_token_put() is called before mt7615_dma_cleanup(). The fix was implemented in upstream commit 8ab31da7b89f71c4c2defcca989fab7b42f87d71 and backported to affected stable kernel versions (Kernel Patch).