CVE-2021-47612 is a vulnerability identified in the Linux kernel's NFC (Near Field Communication) subsystem, specifically within the nfc_genl_dump_devices_done() function. The issue arises when the kernel memory allocation function kmalloc fails during the execution of nfc_genl_dump_devices(). This failure leads to a null pointer dereference in nfc_genl_dump_devices_done(), causing a segmentation fault (segfault). The segfault is confirmed by Kernel Address Sanitizer (KASAN) reports indicating a null pointer dereference at a low memory address range. The call trace shows the fault occurs during the cleanup and destruction of netlink sockets related to NFC device enumeration. This vulnerability can cause a kernel crash (denial of service) when the NFC subsystem attempts to dump device information and memory allocation fails. The affected Linux kernel versions include those identified by the commit hash 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, which suggests a specific patch or kernel state before the fix was applied. There are no known exploits in the wild, and no CVSS score has been assigned yet. The vulnerability does not appear to allow privilege escalation or arbitrary code execution but can impact system availability by causing kernel panics or crashes when NFC device enumeration is triggered under low-memory conditions or other kmalloc failure scenarios.

For European organizations, the primary impact of CVE-2021-47612 is the potential for denial of service on Linux systems utilizing NFC functionality. This could disrupt services or operations relying on NFC communication, such as secure access control, contactless payments, or device pairing in industrial or enterprise environments. While the vulnerability does not directly expose confidentiality or integrity risks, the availability impact could be significant in environments where uptime and reliability are critical, such as manufacturing plants, transportation systems, or financial institutions using NFC-enabled devices. Organizations running Linux kernels with NFC support in embedded devices, IoT gateways, or servers could experience unexpected reboots or service interruptions if the vulnerability is triggered. The lack of known exploits reduces immediate risk, but the vulnerability should be addressed promptly to avoid potential exploitation or accidental crashes.

1. Apply the latest Linux kernel updates that include the patch fixing this vulnerability. The patch addresses the null pointer dereference by properly handling kmalloc failure scenarios in the NFC subsystem. 2. If immediate patching is not possible, consider disabling NFC support in the kernel or unloading the NFC kernel modules (e.g., nfc, nfc_genl) to prevent the vulnerable code from executing. 3. Monitor system logs for kernel warnings or crashes related to NFC device enumeration or netlink socket destruction to detect potential exploitation attempts or accidental triggers. 4. Implement resource monitoring and limits to reduce the likelihood of kmalloc failures due to memory exhaustion, such as configuring cgroups or system memory limits. 5. For critical systems, conduct controlled testing of NFC functionality after patching to ensure stability and confirm the vulnerability is mitigated. 6. Maintain an inventory of Linux systems with NFC enabled and prioritize patching based on exposure and criticality.