CVE-2021-47416: phy: mdio: fix memory leak

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-21 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: phy: mdio: fix memory leak Syzbot reported memory leak in MDIO bus interface, the problem was in wrong state logic. MDIOBUS_ALLOCATED indicates 2 states: 1. Bus is only allocated 2. Bus allocated and __mdiobus_register() fails, but device_register() was called In case of device_register() has been called we should call put_device() to correctly free the memory allocated for this device, but mdiobus_free() calls just kfree(dev) in case of MDIOBUS_ALLOCATED state To avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED _before_ calling device_register(), because put_device() should be called even in case of device_register() failure.

Affected products

Linux kernel: from 2.6.28 before 4.4.289; from 4.5 before 4.9.287; from 4.10 before 4.14.251; from 4.15 before 4.19.211; from 4.20 before 5.4.153; from 5.5 before 5.10.73 — fixed in 4.14.251, 4.19.211, 4.4.289, 4.9.287, 5.10.73, 5.14.12

How to fix

Upgrade to a fixed version: Linux kernel 4.14.251, 4.19.211, 4.4.289, 4.9.287. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47416 or the next vulnerability affects your stack