CVE-2021-47631: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, CVE-2021-47631 addresses a NULL pointer dereference vulnerability in the da850evmconfigemac() function. The issue occurs when booting multiv5defconfig in QEMU under the palmetto-bmc machine with newer versions of GCC. The vulnerability exists because davincisocinfo only gets populated on davinci machines, but da850evmconfigemac() is called on all machines via device_initcall() (Kernel Git).

The vulnerability is triggered when the emacpdata pointer in socinfo is NULL, causing a kernel panic when attempting to access rmiien. The issue manifests as a NULL pointer dereference at virtual address 00000020, resulting in an internal error (Oops: 5) on ARM systems. The problem stems from improper ordering of operations where rmiien is accessed before verifying if the current machine is a supported SoC (Kernel Git).

When triggered, this vulnerability causes a kernel panic, leading to a system crash. This results in a denial of service condition on affected systems running the vulnerable kernel version (Kernel Git).

The fix involves moving the rmii_en assignment below the machine check so that it is only dereferenced when running on a supported SoC. This ensures that the pointer is only accessed after verifying the correct machine type (Kernel Git).