CVE-2021-47074

What it actually does

Failure to free an allocated nvme_loop_ctrl structure when nvme_init_ctrl() returns an error in nvme_loop_create_ctrl() results in a kernel memory leak.

Why it matters to the business

Repeated triggering of the error path can gradually exhaust kernel memory on systems using NVMe loopback transports, leading to degraded performance, instability, or eventual denial of service.

How an attack unfolds

An attacker with local access or the ability to induce repeated controller creation failures (for example via crafted loop device configuration attempts) causes the kernel to leak memory on each failed initialization without recovery.

How to fix it

Apply the upstream kernel patch or upgrade to a Linux kernel version containing the fix for the memory leak in nvme_loop_create_ctrl().

How to confirm the fix worked

Confirm the presence of the corrected nvme_loop_create_ctrl() code path that frees the ctrl structure before the out label on nvme_init_ctrl() failure; review kernel changelog or source for the commit.

Typical attack path

1. Obtain ability to trigger nvme_loop_create_ctrl() calls
2. Force nvme_init_ctrl() to fail repeatedly
3. Accumulate leaked kernel memory objects over multiple attempts
4. Induce system-wide memory pressure or crash

How to detect it

Review kernel memory statistics and slab allocator usage for unexpected growth in NVMe-related objects; correlate with logs showing repeated nvme_loop_create_ctrl failures.

What your security team should do

• Prioritize kernel updates on any systems exposing NVMe loopback interfaces
• Monitor for memory usage anomalies on storage subsystems
• Restrict unprivileged access to loop device configuration where feasible