CVE-2021-47119

What it actually does

Failure to release buffer head references before kill_bdev() in ext4_fill_super causes superblock buffer heads and their pages to leak when block sizes differ and sb_set_blocksize() is invoked.

Why it matters to the business

Repeated mount and unmount operations on ext4 volumes, especially under LVM with systemd cgroups, lead to gradual memory exhaustion that can trigger out-of-memory conditions and degrade system stability.

How an attack unfolds

An attacker or automated process triggers repeated mount/unmount cycles of ext4 file systems on LVM devices, amplifying buffer-head leaks inside dying memory cgroups until available memory is depleted.

How to fix it

Update to a kernel containing the fix for the ext4 buffer-head leak; apply the corrected package versions listed for affected distributions.

How to confirm the fix worked

Confirm the kernel version includes the ext4_fill_super buffer-head release fix, then reproduce the mount/unmount loop and monitor for absence of buffer-head leaks via slabinfo or kmemleak.

Typical attack path

1. Identify systems with ext4 on LVM and frequent mount activity via systemd
2. Issue repeated mount and unmount operations
3. Observe memory consumption growth from unreleased buffer heads
4. Continue cycling until memory pressure causes OOM or service degradation

How to detect it

Review kernel logs for repeated ext4 mount and superblock operations, correlate with rising slab memory usage for buffer heads, and inspect kmemleak reports after mount/unmount stress tests.

What your security team should do

• Prioritize patching systems that frequently mount and unmount ext4 volumes
• Monitor memory usage trends on storage servers and containers
• Limit unprivileged mount capabilities where possible