CVE-2021-47612 nfc: fix segfault in nfc_genl_dump_devices_done

Medium 5.5 Published 19 Jun 2024 Updated 11 May 2026

A null pointer dereference in the Linux kernel NFC subsystem allows local attackers to cause a system crash via a failed memory allocation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-47612?

CVE-2021-47612 is a medium-severity vulnerability in Linux kernel, published on 19 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

nfc: fix segfault in nfc_genl_dump_devices_done

When kmalloc in nfc_genl_dump_devices() fails then nfc_genl_dump_devices_done() segfaults as below

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 25 Comm: kworker/0:1 Not tainted 5.16.0-rc4-01180-g2a987e65025e-dirty #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-6.fc35 04/01/2014 Workqueue: events netlink_sock_destruct_work RIP: 0010:klist_iter_exit+0x26/0x80 Call Trace: <TASK> class_dev_iter_exit+0x15/0x20 nfc_genl_dump_devices_done+0x3b/0x50 genl_lock_done+0x84/0xd0 netlink_sock_destruct+0x8f/0x270 __sk_destruct+0x64/0x3b0 sk_destruct+0xa8/0xd0 __sk_free+0x2e8/0x3d0 sk_free+0x51/0x90 netlink_sock_destruct_work+0x1c/0x20 process_one_work+0x411/0x710 worker_thread+0x6fd/0xa80

Weakness: CWE-476

Which versions are affected by CVE-2021-47612?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2021-47612?

Apply the vendor's patch.

Is CVE-2021-47612 being exploited?

There is no known exploitation of CVE-2021-47612 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-47612, GHSA-7vv8-23mh-rqfj, UBUNTU-CVE-2021-47612.