CVE-2021-47598: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47598 is a vulnerability in the Linux kernel's CAKE (Common Applications Kept Enhanced) qdisc scheduler implementation. The vulnerability was discovered when qdiscs incorrectly called their own destroy() method from init(), which was not supposed to happen as the core stack already handles this functionality (Kernel Commit).

The vulnerability exists in the cakeinit() function within net/sched/schcake.c where cake_destroy() was incorrectly called during initialization. This could lead to a use-after-free condition, which was confirmed by syzbot through debugging output showing mutex lock magic value corruption. The issue stems from the original implementation added by commit 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") (Kernel Commit).

The vulnerability could result in a use-after-free condition in the Linux kernel's network scheduling subsystem. This could potentially lead to system instability or crashes when configuring network queuing disciplines (Kernel Commit).

The issue was fixed by removing the call to cakedestroy() from the cakeinit() function and instead directly returning -ENOMEM on allocation failure. The fix was implemented in the Linux kernel through a patch authored by Eric Dumazet and reviewed by Toke Høiland-Jørgensen (Kernel Commit).