CVE-2021-47002

What it actually does

Null pointer dereference in svc_rqst_free() after alloc_pages_node() fails in svc_rqst_alloc(), causing kernel panic or denial of service in the SUNRPC subsystem.

Why it matters to the business

Local users or processes can trigger system crashes that interrupt network services and require reboots, with higher urgency for organizations running older unpatched kernels in production RPC workloads.

How an attack unfolds

An attacker with local access forces an allocation failure during RPC request setup so that the subsequent free path dereferences a null scratch page pointer, resulting in a kernel crash; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade to a Linux kernel containing the null-check fix in svc_rqst_free(); apply the patch referenced by the upstream commit that resolves the Coverity warning.

How to confirm the fix worked

Confirm the null check exists before the put_page() call in svc_rqst_free() by inspecting kernel source or running targeted allocation-failure tests; verify the running kernel version is newer than the vulnerable commit.

Typical attack path

1. Gain local user or process execution on an affected Linux system
2. Trigger conditions that cause alloc_pages_node() to return null inside svc_rqst_alloc()
3. Invoke svc_rqst_free() which dereferences the null rq_scratch_page pointer
4. Observe resulting kernel panic or denial of service

How to detect it

Search kernel logs and crash dumps for oops or panic messages referencing svc_rqst_free, put_page, or null dereference in the SUNRPC path; correlate with recent local process activity that performs RPC allocations.

What your security team should do

• Apply the upstream kernel patch or upgrade to a fixed distribution kernel immediately on systems exposing RPC services
• Monitor kernel logs for SUNRPC-related null dereference oops entries
• Restrict local access where feasible until patches are deployed