5.5

CVE-2021-47180: NFC: nci: fix memory leak in nci_allocate_device

Analyzed
AliasesUBUNTU-CVE-2021-47180DEBIAN-CVE-2021-47180
Published 25-03-2024Last modified 11-05-2026

Vulnerability summary

CVE-2021-47180 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.23%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 6
SUSE-SU-2024:1454-1SUSE-SU-2024:1465-1SUSE-SU-2024:1489-1SUSE-SU-2024:1643-1SUSE-SU-2024:1646-1SUSE-SU-2024:1870-1

Timeline

  1. 25-03-2024
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: NFC: nci: fix memory leak in nci_allocate_device nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev. Fix this by freeing hci_dev in nci_free_device. BUG: memory leak unreferenced object 0xffff888111ea6800 (size 1024): comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff .........`...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline] [<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline] [<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784 [<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline] [<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132 [<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153 [<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345 [<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 [<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740 [<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846 [<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431 [<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914 [<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491 [<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109 [<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164 [<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.23%

Chance of exploitation in the next 30 days

Percentile

13%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.23% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu86 products
  • linuxAll versions (No fix recorded) | < 4.15.0-151.157 | < 5.4.0-80.90
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 4.15.0-1109.116 | < 5.4.0-1054.57
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < 448a1cb12977f52142e6feb12022c59662d88dc1 | ≥ 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < 4a621621c7af3cec21c47c349b30cd9c3cea11c8 | ≥ 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < 2c2fb2df46ea866b49fea5ec7112ec3cd4896c74 | ≥ 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < 0365701bc44e078682ee1224866a71897495c7ef | ≥ 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < af2a4426baf71163c0c354580ae98c7888a9aba7 | ≥ 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < b34cb7ac32cc8e5471dc773180ea9ae676b1a745 | ≥ 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < 65234f50a90b64b335cbb9164b8a98c2a0d031dd | ≥ 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < e0652f8bb44d6294eeeac06d703185357f25d50b | 4.0
  • linux_kernel≥ 4.0, < 4.4.271 | ≥ 4.5, < 4.9.271 | ≥ 4.10, < 4.14.235 | ≥ 4.15, < 4.19.193 | ≥ 4.20, < 5.4.123 | ≥ 5.5, < 5.10.41 | ≥ 5.11, < 5.12.8 | 5.13:rc1 | 5.13:rc2 | 5.13:rc3
Debian1 product
  • linux< 5.14.6-1

3 vendors · 89 products

References

11 links
Show all 11 references