CVE-2021-47479
staging: rtl8712: fix use-after-free in rtl8712_dl_fw
Reported by linux · Published May 22, 2024
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8712: fix use-after-free in rtl8712_dl_fw Syzbot reported use-after-free in rtl8712_dl_fw(). The problem was in race condition between r871xu_dev_remove() ->ndo_open() callback. It's easy to see from crash log, that driver accesses released firmware in ->ndo_open() callback. It may happen, since driver was releasing firmware _before_ unregistering netdev. Fix it by moving unregister_netdev() before cleaning up resources. Call Trace: ... rtl871x_open_fw drivers/staging/rtl8712/hal_init.c:83 [inline] rtl8712_dl_fw+0xd95/0xe10 drivers/staging/rtl8712/hal_init.c:170 rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline] rtl871x_hal_init+0xae/0x180 drivers/staging/rtl8712/hal_init.c:394 netdev_open+0xe6/0x6c0 drivers/staging/rtl8712/os_intfs.c:380 __dev_open+0x2bc/0x4d0 net/core/dev.c:1484 Freed by task 1306: ... release_firmware+0x1b/0x30 drivers/base/firmware_loader/main.c:1053 r871xu_dev_remove+0xcc/0x2c0 drivers/staging/rtl8712/usb_intf.c:599 usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:458
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| linux_kernel | linux | 5.15.2, 5.14.18, 5.10.79, 3.3 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 8c213fa59199f9673d66970d6940fa093186642f, 8c213fa59199f9673d66970d6940fa093186642f, 8c213fa59199f9673d66970d6940fa093186642f |
| Linux | Linux | 3.3, 0, 5.10.79 |
| linux | linux_kernel | 3.3, 3.3, 3.3 |
| Linux | Linux | *, 3.3, 0 |
Timeline
- May 22, 2024 CVE Published
- May 23, 2024 EPSS Score (30 in total, the first dated here)
- Sep 24, 2025 CVE Updated
- Jun 2, 2026 Security Advisory (259 in total, the first dated here)
- Jul 13, 2026 Coalition ESS Score
- Oct 30, 2026 Distribution Patch (166 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-47479
vulnetix vdb fixes CVE-2021-47479Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-47479/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart