CVE-2021-47122: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47122 is a memory leak vulnerability discovered in the Linux kernel's CAIF (Communication CPU to Application CPU Interface Framework) subsystem. The issue specifically affects the caif_device_notify function where allocated link_support memory is not properly freed when caif_enroll_dev() fails. This vulnerability was disclosed on March 15, 2024, and affects Linux kernel versions from 3.3 through multiple branches up to versions before 4.4.272, 4.9.272, 4.14.236, 4.19.194, and 5.4.125 (NVD).

The vulnerability occurs in the net/caif/caif_dev.c file where the caif_device_notify function fails to properly handle memory allocation failures. When caif_enroll_dev() fails, the allocated link_support pointer is not freed, leading to a memory leak. The issue was identified as CWE-401 (Missing Release of Memory after Effective Lifetime). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to memory leaks in the Linux kernel when the CAIF subsystem is in use. While the impact is limited to availability (no confidentiality or integrity impacts), it could potentially lead to system resource exhaustion over time if repeatedly triggered (Red Hat).

The vulnerability requires local access with low privileges to exploit. No active exploits have been reported in the wild, though the vulnerability was discovered and tested by the syzkaller automated testing system (Kernel.org).

The vulnerability has been fixed through a patch that properly frees the allocated link_support pointer in case of caif_enroll_dev() failure. The fix has been backported to multiple kernel versions and is available in kernel updates. Users should update their Linux kernel to versions 4.4.272, 4.9.272, 4.14.236, 4.19.194, 5.4.125 or later depending on their branch (NVD).