NFC: nci: fix memory leak in nci_allocate_device
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-401.
Summary
In the Linux kernel, the following vulnerability has been resolved: NFC: nci: fix memory leak in nci_allocate_device nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev. Fix this by freeing hci_dev in nci_free_device. BUG: memory leak unreferenced object 0xffff888111ea6800 (size 1024): comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff .........`...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline] [<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline] [<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784 [<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline] [<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132 [<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153 [<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345 [<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 [<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740 [<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846 [<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431 [<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914 [<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491 [<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109 [<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164 [<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 4.0 and later | 4.4.271, 4.9.271, 4.14.235, 4.19.193, 5.4.123, 5.10.41, 5.12.8, 5.13 | Patch available | CNA |
- Linux VendorLinux Affected 4.0 and later Fixed in 4.4.271, 4.9.271, 4.14.235, 4.19.193, 5.4.123, 5.10.41, 5.12.8, 5.13 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.0 to before 4.4.271; 4.5 to before 4.9.271; 4.10 to before 4.14.235; 4.15 to before 4.19.193; 4.20 to before 5.4.123; 5.5 to before 5.10.41; 5.11 to before 5.12.8 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:* | 5.13 rc1 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:* | 5.13 rc2 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:* | 5.13 rc3 | Vulnerable | Linux |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.0 to before 4.4.271; 4.5 to before 4.9.271; 4.10 to before 4.14.235; 4.15 to before 4.19.193; 4.20 to before 5.4.123; 5.5 to before 5.10.41; 5.11 to before 5.12.8 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:* Versions 5.13 rc1 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:* Versions 5.13 rc2 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:* Versions 5.13 rc3 Vulnerable ·Linux
Remediation
- Fix · CNA Linux (Linux) Fixed in 4.4.271, 4.9.271, 4.14.235, 4.19.193, 5.4.123, 5.10.41, 5.12.8, 5.13
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-47180
- 2026-10-03 Alias added: GHSA-jwrw-gr4p-2mx9
References
Patch 8
- https://git.kernel.org/stable/c/448a1cb12977f52142e6feb12022c59662d88dc1
- https://git.kernel.org/stable/c/4a621621c7af3cec21c47c349b30cd9c3cea11c8
- https://git.kernel.org/stable/c/2c2fb2df46ea866b49fea5ec7112ec3cd4896c74
- https://git.kernel.org/stable/c/0365701bc44e078682ee1224866a71897495c7ef
- https://git.kernel.org/stable/c/af2a4426baf71163c0c354580ae98c7888a9aba7
- https://git.kernel.org/stable/c/b34cb7ac32cc8e5471dc773180ea9ae676b1a745
- https://git.kernel.org/stable/c/65234f50a90b64b335cbb9164b8a98c2a0d031dd
- https://git.kernel.org/stable/c/e0652f8bb44d6294eeeac06d703185357f25d50b
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2021-47180 · CVE Program
- CVE-2021-47180 · NVD
- FIRST EPSS
- GHSA-jwrw-gr4p-2mx9 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-47180 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences