CVE-2021-47000

What it actually does

The vulnerability causes an inode memory leak when getattr encounters an error path inside __fh_to_dentry in the Ceph filesystem driver.

Why it matters to the business

Over time the leak can exhaust kernel memory on Ceph clients, resulting in degraded performance, instability, or crashes on Linux systems that mount Ceph filesystems.

How an attack unfolds

An attacker or misbehaving client triggers repeated getattr failures through malformed directory-handle operations; each failure leaks an inode structure that is never freed, gradually consuming memory until the system becomes unusable.

How to fix it

Upgrade the Linux kernel to a version that includes the fix for the inode leak in __fh_to_dentry; apply the latest distribution kernel package containing the Ceph patch.

How to confirm the fix worked

Confirm the running kernel contains the commit that resolves the getattr error leak; monitor inode and slab memory counters under error-inducing workloads to verify leaks no longer occur.

Typical attack path

1. Mount a Ceph filesystem on a vulnerable kernel
2. Issue or induce getattr operations that return errors in __fh_to_dentry
3. Repeat the error condition to accumulate leaked inodes
4. Observe memory pressure and eventual denial of service

How to detect it

Search kernel logs and slabinfo or /proc/meminfo for unusual growth in inode or ceph-related slab caches after getattr error events; correlate with Ceph client activity logs.

What your security team should do

• Prioritize kernel updates on all Ceph clients within standard change windows
• Review Ceph mount options and error-handling paths in automation
• Add memory-usage alerting for Ceph client nodes