CVE-2021-47150: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47150 is a memory leak vulnerability in the Linux kernel's Freescale Ethernet Controller (FEC) driver. The issue was discovered in the fec_enet_init() function, where memory allocated for queues could potentially leak if the allocation of cbd_base fails. The vulnerability was publicly disclosed in March 2024 and affects various Linux kernel versions (CVE Details).

The vulnerability exists in the Linux kernel's FEC driver implementation, specifically in the fec_enet_init() function. The issue occurs when memory allocation for cbd_base fails, as the previously allocated memory for queues is not properly freed, resulting in a memory leak. Additionally, if the memory allocation for queues fails, the function should return an error directly. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Portal).

The vulnerability can lead to memory leaks in the Linux kernel when using the Freescale Ethernet Controller driver. While memory leaks don't typically allow for direct system compromise, they can cause system resource depletion over time, potentially affecting system stability and performance (Red Hat Portal).

The vulnerability requires local access to the system and high privileges to exploit, making it relatively difficult to take advantage of in practice. There are no known public exploits targeting this vulnerability (Red Hat Portal).

The vulnerability has been fixed in the Linux kernel through a patch that properly handles memory deallocation in error cases. The fix ensures that if memory allocation for cbd_base fails, the previously allocated queue memory is properly freed, and if queue allocation fails, an error is returned immediately. The patch has been backported to various maintained kernel versions (Kernel Commit).