CVE-2021-47361: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability has been identified in the mcb (MicroChannel Bus) subsystem's error handling functionality within mcb_alloc_bus(). The vulnerability affects Linux kernel versions from 4.7 through 5.15-rc2 (NVD).

The vulnerability stems from two distinct bugs in the error handling code: 1) A potential use-after-free condition where put_device(carrier) is called without a preceding get_device(carrier) when ida_simple_get() fails, and 2) Improper resource cleanup where device resources need to be released using put_device() after device_initialize() to properly free internal resources and trigger mcb_free_bus(). The vulnerability has been assigned a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-416 (Use After Free) (NVD).

The vulnerability could lead to use-after-free conditions in the kernel, potentially resulting in system crashes, information disclosure, or privilege escalation in the context of the Linux kernel (Kernel Patch).

The vulnerability requires local access and low privileges to exploit. An attacker would need to interact with the MicroChannel Bus subsystem to trigger the vulnerable code path (NVD).

The vulnerability has been fixed in the Linux kernel through a patch that corrects the error handling in mcb_alloc_bus(). The fix involves properly handling device cleanup and resource management. Users should upgrade to patched kernel versions that include the fix (Kernel Patch).