CVE-2021-47024

What it actually does

Memory leak in Linux kernel vsock/virtio when closing sockets due to undrained RX queue packets after partial fix in prior commit.

Why it matters to the business

Prolonged operation with frequent vsock socket creation and closure can exhaust kernel memory, leading to degraded performance, instability, or denial of service on affected systems; low exploitation likelihood reduces immediate urgency despite long availability.

How an attack unfolds

An attacker repeatedly opens and closes vsock sockets over virtio transport, triggering the scheduled work that fails to drain the RX queue before socket removal from af_vsock lists, accumulating unreleased packet memory until exhaustion.

How to fix it

Update the Linux kernel to a version containing the fix that uses virtio_transport_remove_sock to drain the RX queue before vsock_remove_sock; rebuild and deploy the patched kernel across all affected hosts.

How to confirm the fix worked

Verify kernel source contains the referenced commit or equivalent change draining RX queue on socket close; test by exercising vsock close paths under memory accounting tools to confirm no residual packet allocations.

Typical attack path

1. Establish multiple vsock connections via virtio transport
2. Trigger socket closure paths that invoke scheduled release work
3. Omit or bypass RX queue drain via virtio_transport_remove_sock
4. Repeat to accumulate leaked packet allocations
5. Monitor for kernel memory pressure or OOM conditions

How to detect it

Inspect kernel logs and memory statistics for repeated vsock socket close operations without corresponding packet frees; correlate high slab or page cache usage with virtio transport activity in environments using vsock.

What your security team should do

• Apply kernel updates containing the vsock drain fix as soon as feasible
• Monitor systems for unexplained kernel memory growth correlated with vsock usage
• Limit exposure of virtio vsock interfaces to trusted workloads only
• Review downstream distributions for backported fixes given the long disclosure window