CVE-2021-46968

What it actually does

Failure to properly decrement embedded kref counters on hot-unplug of zcard and zqueue structs prevents the release callback from firing, leaving kernel memory allocated.

Why it matters to the business

Systems that perform repeated hot-unplug of cryptographic accelerator hardware may experience gradual kernel memory exhaustion, leading to performance degradation or eventual instability.

How an attack unfolds

An attacker with local access repeatedly triggers hot-unplug events against zcrypt devices; each event leaks memory because the initial kref value is never fully released, eventually exhausting kernel resources.

How to fix it

Apply a kernel update that initializes the kref to 1 at card/queue creation and ensures the unregister path drops the reference to zero so the release function frees the objects.

How to confirm the fix worked

Boot a kmemdebug-enabled kernel, perform hot-unplug cycles, and confirm that zcard and zqueue objects are released; alternatively, inspect the zcrypt driver source for the corrected kref handling.

Typical attack path

1. Obtain local shell or privileged access on an s390 system using zcrypt
2. Cause or simulate repeated hot-unplug of zcard or zqueue devices
3. Observe increasing kernel memory consumption without corresponding frees

How to detect it

Review kernel logs and memory debug output for zcard or zqueue objects that remain allocated after hot-unplug; correlate with dmesg entries showing zcrypt unregister activity.

What your security team should do

• Identify s390 systems that load the zcrypt driver and apply the fix during the next kernel update cycle
• Enable memory debugging on test systems to validate the patch before broad rollout
• Monitor kernel memory statistics for unexpected growth correlated with hardware reconfiguration events