CVE-2021-47480: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47480 is a vulnerability in the Linux kernel's SCSI subsystem that was discovered and disclosed in May 2024. The issue specifically affects the SCSI core component, where there was an improper handling of module reference counting during SCSI device release operations (NVD).

The vulnerability occurs in the SCSI host release mechanism which is triggered when a SCSI device is freed. The core issue was that the low-level device driver (LLD) module could potentially be unloaded before the SCSI host instance was properly released, leading to a situation where shost->hostt was required in the release handler but might no longer be available. This could result in a kernel panic with the error 'BUG: unable to handle page fault for address' (Kernel Commit).

When exploited, this vulnerability could lead to a kernel panic, effectively causing a denial of service condition on affected systems. The issue specifically impacts systems running the Linux kernel with SCSI devices (NVD).

The vulnerability was discovered through normal system operations rather than malicious exploitation. It was initially reported by researchers Changhui Zhong and Yi Zhang who encountered the kernel panic during system operations (Kernel Commit).

The issue has been resolved by modifying the module reference counting mechanism to ensure the LLD module reference count is properly handled after the SCSI device is released. The fix involves storing the module pointer and putting the LLD module reference count after the SCSI device is fully released (Kernel Commit).