CVE-2021-47151: Vulnerability in Linux Linux
In the Linux kernel, the following vulnerability has been resolved: interconnect: qcom: bcm-voter: add a missing of_node_put() Add a missing of_node_put() in of_bcm_voter_get() to avoid the reference leak.
AI Analysis
Technical Summary
CVE-2021-47151 is a vulnerability identified in the Linux kernel, specifically within the interconnect subsystem related to Qualcomm's bcm-voter component. The issue arises from a missing call to of_node_put() in the function of_bcm_voter_get(). This missing call leads to a reference leak, meaning that the kernel fails to properly decrement the reference count on a device tree node object after it is no longer needed. Over time, such leaks can cause resource exhaustion within the kernel, potentially leading to degraded system performance or instability. The vulnerability does not directly allow for code execution or privilege escalation but represents a resource management flaw that could be exploited indirectly by causing denial of service conditions. The fix involves adding the missing of_node_put() call to ensure proper release of resources and prevent the leak. No known exploits are currently reported in the wild, and no CVSS score has been assigned to this vulnerability.
Potential Impact
For European organizations relying on Linux-based systems, especially those using kernels with Qualcomm interconnect components, this vulnerability could lead to system instability or denial of service due to resource leaks. This is particularly relevant for embedded systems, telecommunications infrastructure, and IoT devices that utilize Qualcomm hardware and run Linux kernels incorporating the bcm-voter interconnect driver. While the vulnerability does not directly compromise confidentiality or integrity, the availability of critical systems could be affected if resource exhaustion occurs. This could impact service continuity in sectors such as telecommunications, manufacturing, and critical infrastructure. Given the widespread use of Linux in servers and embedded devices across Europe, organizations should be aware of this vulnerability's potential to degrade system reliability if left unpatched.
Mitigation Recommendations
Organizations should promptly update their Linux kernel to a version that includes the patch fixing CVE-2021-47151. Since this vulnerability is a resource leak, monitoring system logs and kernel resource usage for abnormal patterns can help detect potential exploitation attempts. For embedded and IoT devices, ensure firmware updates are applied from vendors that have incorporated this fix. Additionally, implement strict access controls and limit untrusted user or process interactions with kernel interfaces related to the interconnect subsystem to reduce the risk of triggering the leak. Employing kernel hardening techniques and continuous system health monitoring will further mitigate the risk of denial of service caused by resource exhaustion.
Affected Countries
Germany, France, United Kingdom, Italy, Spain, Netherlands, Sweden, Finland
CVE-2021-47151: Vulnerability in Linux Linux
Description
In the Linux kernel, the following vulnerability has been resolved: interconnect: qcom: bcm-voter: add a missing of_node_put() Add a missing of_node_put() in of_bcm_voter_get() to avoid the reference leak.
AI-Powered Analysis
Technical Analysis
CVE-2021-47151 is a vulnerability identified in the Linux kernel, specifically within the interconnect subsystem related to Qualcomm's bcm-voter component. The issue arises from a missing call to of_node_put() in the function of_bcm_voter_get(). This missing call leads to a reference leak, meaning that the kernel fails to properly decrement the reference count on a device tree node object after it is no longer needed. Over time, such leaks can cause resource exhaustion within the kernel, potentially leading to degraded system performance or instability. The vulnerability does not directly allow for code execution or privilege escalation but represents a resource management flaw that could be exploited indirectly by causing denial of service conditions. The fix involves adding the missing of_node_put() call to ensure proper release of resources and prevent the leak. No known exploits are currently reported in the wild, and no CVSS score has been assigned to this vulnerability.
Potential Impact
For European organizations relying on Linux-based systems, especially those using kernels with Qualcomm interconnect components, this vulnerability could lead to system instability or denial of service due to resource leaks. This is particularly relevant for embedded systems, telecommunications infrastructure, and IoT devices that utilize Qualcomm hardware and run Linux kernels incorporating the bcm-voter interconnect driver. While the vulnerability does not directly compromise confidentiality or integrity, the availability of critical systems could be affected if resource exhaustion occurs. This could impact service continuity in sectors such as telecommunications, manufacturing, and critical infrastructure. Given the widespread use of Linux in servers and embedded devices across Europe, organizations should be aware of this vulnerability's potential to degrade system reliability if left unpatched.
Mitigation Recommendations
Organizations should promptly update their Linux kernel to a version that includes the patch fixing CVE-2021-47151. Since this vulnerability is a resource leak, monitoring system logs and kernel resource usage for abnormal patterns can help detect potential exploitation attempts. For embedded and IoT devices, ensure firmware updates are applied from vendors that have incorporated this fix. Additionally, implement strict access controls and limit untrusted user or process interactions with kernel interfaces related to the interconnect subsystem to reduce the risk of triggering the leak. Employing kernel hardening techniques and continuous system health monitoring will further mitigate the risk of denial of service caused by resource exhaustion.
Affected Countries
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Linux
- Date Reserved
- 2024-03-04T18:12:48.846Z
- Cisa Enriched
- true
- Cvss Version
- null
- State
- PUBLISHED
Threat ID: 682d9834c4522896dcbe9ec9
Added to database: 5/21/2025, 9:09:08 AM
Last enriched: 6/26/2025, 7:20:42 PM
Last updated: 12/4/2025, 2:39:00 AM
Views: 33
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
Nation-State Attack or Compromised Government? [Guest Diary], (Thu, Dec 4th)
MediumCVE-2025-62173: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in FreePBX security-reporting
HighCVE-2025-64055: n/a
UnknownCVE-2025-66404: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in Flux159 mcp-server-kubernetes
MediumCVE-2025-66293: CWE-125: Out-of-bounds Read in pnggroup libpng
HighActions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.