CVE-2021-47284 is a vulnerability in the Linux kernel affecting the ISDN subsystem, specifically the mISDN netjet driver. The issue arises in the nj_probe function within netjet.c, where an improper handling of the card->irq variable occurs. When nj_setup fails with an -EIO error, card->irq is initialized to a value greater than zero, but the corresponding IRQ has not actually been requested. Subsequently, the nj_release function attempts to free this IRQ, leading to a free_irq call on an IRQ that was never allocated. This results in a kernel crash and potential kernel panic, as demonstrated by KASAN logs and kernel stack traces included in the vulnerability report. The root cause is a logic error where the assignment to card->irq occurs prematurely before the request_irq call, which is corrected by removing the earlier assignment and only setting card->irq after a successful request_irq. The vulnerability impacts the availability of affected Linux systems by causing crashes and kernel panics during device initialization or probing of the netjet ISDN driver. The CVSS 3.1 score is 4.7 (medium), reflecting a local attack vector with high attack complexity, requiring low privileges but no user interaction, and resulting in availability impact without confidentiality or integrity loss. No known exploits are reported in the wild, and the issue is primarily a denial-of-service condition rather than an escalation or data breach vector. The vulnerability is relevant to Linux kernel versions containing the affected netjet driver code and is particularly relevant in environments using ISDN hardware or virtualization platforms emulating such devices (e.g., QEMU).

For European organizations, the impact of CVE-2021-47284 is primarily related to system availability and stability. Organizations relying on Linux servers or embedded devices with ISDN netjet drivers may experience unexpected kernel crashes leading to service interruptions. This can affect telecommunications infrastructure, legacy industrial systems, or specialized hardware that still uses ISDN technology. Although ISDN usage has declined, certain sectors in Europe, such as telecommunications providers, public safety networks, and industrial control systems, may still operate affected hardware or virtualized environments. The denial-of-service nature of the vulnerability means attackers with local access or the ability to trigger device probing can cause system reboots or downtime, potentially disrupting critical services. However, the requirement for local privileges and high attack complexity limits the risk of widespread exploitation. The vulnerability does not expose data confidentiality or integrity but can degrade operational continuity, which is critical for sectors with stringent uptime requirements. European organizations should assess their use of ISDN-related Linux kernel modules and virtualization setups to determine exposure and prioritize patching accordingly.

To mitigate CVE-2021-47284, European organizations should: 1) Apply the latest Linux kernel patches that address this vulnerability, ensuring the fix to the netjet driver is included. 2) Audit systems for the presence and use of the mISDN netjet driver, disabling or unloading the module if ISDN functionality is not required. 3) For virtualized environments (e.g., QEMU-based), verify that virtual ISDN devices are not exposed unnecessarily, and update hypervisor and guest kernels to patched versions. 4) Implement strict access controls to limit local user privileges, reducing the risk of local exploitation. 5) Monitor kernel logs for signs of free_irq errors or kernel panics related to IRQ handling to detect potential triggering of this vulnerability. 6) Incorporate this vulnerability into incident response and patch management workflows, prioritizing systems where availability is critical. 7) Consider network segmentation and isolation of legacy ISDN systems to limit exposure. These steps go beyond generic advice by focusing on the specific driver and environment contexts relevant to this vulnerability.