CVE-2021-47193: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a memory leak vulnerability (CVE-2021-47193) was discovered in the SCSI pm80xx driver. The vulnerability was disclosed on April 10, 2024, affecting Linux kernel versions up to (excluding) 5.15.5. The issue occurs during the driver removal process (rmmod) where the driver failed to properly release all allocated memory (NVD).

The vulnerability stems from a memory management issue in the Linux kernel's SCSI pm80xx driver where memory allocated for command control blocks (CCBs) was not properly freed during module removal. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access is required and the primary impact is on system availability (NVD).

The vulnerability results in memory leaks during driver removal operations, which could lead to resource exhaustion over time. While the impact is primarily on system availability, it requires local access and privileged permissions to exploit (NVD).

The vulnerability requires local access with privileged permissions to exploit, specifically when removing the pm80xx driver module. The attack complexity is low, but user interaction is not required for exploitation (NVD).

The issue has been fixed in the Linux kernel through a patch that properly frees memory when the module is removed. The fix includes adding proper memory cleanup code in the driver's removal routine to release all allocated CCB resources (Kernel Patch).