CVE-2021-47161: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47161 affects the Linux kernel's SPI Freescale DSPI driver (spi-fsl-dspi). The vulnerability was discovered and disclosed in 2021, involving a resource leak in the error handling path of the probe function. Specifically, the 'dspi_request_dma()' function was not properly undone by a 'dspi_release_dma()' call in the error handling path, though this cleanup was correctly implemented in the remove function (Kernel Git).

The vulnerability stems from a missing cleanup call in the error handling path of the probe function in the Freescale DSPI driver. When an error occurs during device initialization, the code failed to release previously allocated DMA resources, leading to a resource leak. The issue was introduced in the commit that added DMA support for Vybrid (90ba37033cb9) (Kernel Git). The CVSS v3.1 base score for this vulnerability is 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could lead to resource exhaustion in the system due to unreleased DMA resources. This could potentially affect system stability and performance over time as resources remain allocated but unused (NVD).

The vulnerability requires local access and low privileges to exploit. It can only be triggered during device initialization when an error occurs in the probe function of the Freescale DSPI driver (NVD).

The issue has been fixed by adding a proper cleanup call (dspi_release_dma) in the error handling path of the probe function. The fix has been implemented in the Linux kernel through a patch that ensures DMA resources are properly released when an error occurs during initialization (Kernel Git).