CVE-2021-47183: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47183 affects the Linux kernel's SCSI lpfc driver. The vulnerability was discovered in the link down processing functionality, where a NULL pointer dereference can occur during FC link down transitions when PLOGIs are outstanding to fabric well known addresses (NVD). The issue affects Linux kernel versions up to (excluding) 5.15.5.

The vulnerability occurs in the link down processing of the lpfc driver. When Abort WQEs are sent for ELSs before the driver sets the link state to down, the driver expects an ABTS to be sent on the wire. However, the Abort request stalls waiting for the link to come up. In certain conditions, if the driver auto-completes the ELSs and the link comes up, the Abort completions may reference an invalid structure, leading to a NULL pointer dereference. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can result in a NULL pointer dereference, which may cause system crashes. Additionally, driver unload requests may hang with repeated "2878" log messages (Kernel Patch).

The vulnerability requires local access and can be triggered during specific conditions when FC link down transitions occur while PLOGIs are outstanding to fabric well known addresses (NVD).

The vulnerability has been fixed in the Linux kernel by ensuring that Abort sets the flag to avoid link traffic if issued due to conditions where the link failed. The fix is available through kernel patches (Kernel Patch). Users should upgrade to Linux kernel version 5.15.5 or later to address this vulnerability.