CVE-2021-47075

What it actually does

The vulnerability is a memory leak in nvmet_alloc_ctrl() where an error path (cntlid_min exceeding cntlid_max) jumps to out_free_changed_ns_list instead of out_free_sqs, leaving the ctrl->sqs allocation unfreed.

Why it matters to the business

Repeated triggering in NVMe target configurations can cause gradual kernel memory exhaustion, leading to performance degradation, instability, or denial of service on affected Linux systems over time.

How an attack unfolds

An attacker with privileges to configure or interact with an NVMe target subsystem supplies controller ID parameters violating min/max constraints during ctrl creation, forcing the flawed error path and leaking memory structures; repeated invocations accumulate leaks without requiring external network access.

How to fix it

Upgrade the Linux kernel to a version containing the fix that redirects the error path to out_free_sqs in nvmet_alloc_ctrl(); rebuild and reboot affected systems.

How to confirm the fix worked

Inspect the nvmet_alloc_ctrl() function in kernel source to confirm the corrected jump label, apply the patch, and exercise the min/max violation error path while monitoring for leaks with memory profiling tools.

Typical attack path

1. Obtain access to configure an NVMe target subsystem
2. Issue nvmet ctrl allocation request with cntlid_min larger than cntlid_max
3. Trigger the error label jump that skips sqs freeing
4. Repeat allocation attempts to exhaust memory resources

How to detect it

Review kernel logs for nvmet allocation errors, correlate with memory usage metrics from tools like slabtop or kmemleak on systems running NVMe target code, and search for repeated ctrl creation attempts with invalid ID ranges.

What your security team should do

• Prioritize kernel updates on systems exposing NVMe target functionality
• Limit unprivileged access to nvmet configuration interfaces
• Monitor kernel memory usage trends for anomalous growth in storage target workloads