CVE-2021-46996

What it actually does

Causes a memory leak in nftables by failing to release the object name when userdata allocation fails during new object creation.

Why it matters to the business

Gradual memory exhaustion on Linux systems using nftables can degrade performance or trigger crashes during sustained network configuration activity.

How an attack unfolds

An attacker triggers repeated nftables object creation attempts that hit the userdata allocation failure path, leaving object names allocated and slowly depleting available memory.

How to fix it

Apply the upstream kernel patch that releases the object name on userdata allocation failure in nftables object creation.

How to confirm the fix worked

Confirm the kernel contains the fix by reviewing the nftables object creation error path for explicit name release; monitor memory usage under synthetic failure workloads.

Typical attack path

1. Gain ability to issue netfilter/nftables configuration commands
2. Craft repeated object creation requests that force userdata allocation failure
3. Observe cumulative memory growth without corresponding object cleanup

How to detect it

Review kernel logs and memory accounting for repeated nftables object creation failures without corresponding releases; correlate with netfilter configuration change events.

What your security team should do

• Prioritize kernel updates containing the nftables memleak fix on all exposed systems
• Monitor kernel memory statistics for unexpected growth correlated with nftables activity
• Restrict untrusted access to nftables configuration interfaces until patched