CVE-2021-47105

What it actually does

The flaw fails to return xdp_buff pointers to the xsk buffer pool during ring cleanup, instead only NULLing entries, allowing buffers to leak permanently from the umem pool and become unavailable to other sockets.

Why it matters to the business

Systems relying on AF_XDP for high-performance packet processing may experience gradual exhaustion of buffer resources, leading to degraded networking throughput or denial of service for applications using zero-copy sockets.

How an attack unfolds

An attacker with the ability to interact with an AF_XDP socket triggers repeated ring cleanup operations on partially filled rings; each cleanup leaks buffers without returning them to the pool, eventually starving legitimate users of available umem buffers.

How to fix it

Upgrade the Linux kernel to a version containing the fix that adds the missing xsk_buff_free() call and limits cleanup to only the remaining ring space; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains the upstream commit that introduced xsk_buff_free() in the xsk ring cleanup path; test by exercising AF_XDP socket creation and ring operations while monitoring buffer pool counters for leaks.

Typical attack path

1. Obtain or create an AF_XDP socket with a populated umem and fill queue.
2. Manipulate ring state so that entries remain in the SW ring requiring cleanup.
3. Force repeated calls to the ring cleaning routine without full consumption of entries.
4. Observe progressive depletion of the global xsk buffer pool across sockets.

How to detect it

Review kernel logs for repeated xsk-related warnings or buffer allocation failures; inspect /proc or BPF maps tracking xsk umem usage for unexpected growth in leaked buffer counts on systems with active AF_XDP sockets.

What your security team should do

• Prioritize kernel updates on any hosts exposing AF_XDP sockets to untrusted workloads.
• Audit systems for custom or third-party code using AF_XDP and schedule testing after patching.
• Monitor EPSS and KEV updates for this issue given its presence in the mainline kernel tree.