CVE-2021-45486

What it actually does

The flaw permits information leakage from the kernel IPv4 routing subsystem because the hash table in net/ipv4/route.c is sized too small, allowing inference of routing entries via hash collisions or observable patterns.

Why it matters to the business

Organizations running affected Linux kernels face limited exposure of network routing metadata on local segments, raising the importance of kernel hygiene across large fleets and downstream Oracle products despite low exploitability signals.

How an attack unfolds

An attacker positioned on the same local network observes or probes the IPv4 routing hash table behavior to extract otherwise protected route details; no named threat actors have been observed leveraging this issue and EPSS remains low with minimal upward trend.

How to fix it

Upgrade the Linux kernel to version 5.12.4 or newer; apply vendor patches for Oracle Communications Cloud Native Core products that consume the affected kernel; verify the update resolves the small hash table size in net/ipv4/route.c.

How to confirm the fix worked

Confirm running kernel is 5.12.4 or later via uname or package manager; review route.c source or runtime hash table sizing if source access exists; test that routing information no longer leaks under controlled local network observation.

Typical attack path

1. Obtain a presence on the same local network segment as the target
2. Send crafted or observed IPv4 traffic to trigger hash table lookups
3. Analyze timing or collision patterns to infer routing table contents
4. Use disclosed route information to refine further reconnaissance

How to detect it

Review kernel logs and network flow records for anomalous IPv4 route cache behavior or repeated hash table probes; correlate with local network access attempts; no public exploitation artifacts are known.

What your security team should do

• Apply kernel updates to 5.12.4+ across all Linux instances as a priority given the 1761-day exposure window
• Limit local network adjacency where possible through segmentation
• Include this class of kernel information leaks in routine kernel update policies
• Monitor EPSS and KEV status for any future elevation