CVE-2021-47258: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47258 affects the Linux kernel's SCSI subsystem, specifically related to error handling in the scsi_host_alloc() function. The vulnerability was discovered and disclosed in May 2024. The issue occurs after device initialization via device_initialize() or when the device name is set via dev_set_name(), where the device name could be leaked due to improper memory management (NVD).

The vulnerability stems from improper memory management in the SCSI core subsystem. When a device is initialized or its name is set, the device name is allocated dynamically in dev_set_name(). The original code used kfree() for cleanup, but this was incorrect as the proper cleanup method should be put_device() to prevent memory leaks. The issue specifically affects the error handling paths in scsi_host_alloc() function (Kernel Commit).

The vulnerability results in a memory leak condition where device names allocated during SCSI host initialization are not properly freed. This occurs because the cleanup process uses incorrect deallocation methods, potentially leading to resource exhaustion over time (NVD).

The issue has been fixed by replacing kfree() with put_device() in the error handling path. Additionally, since scsi_host_dev_release() properly handles IDA and kthread removal, special-case handling was removed from the error handling. The fix has been implemented and merged into the Linux kernel (Kernel Commit).