CVE-2021-47121

What it actually does

A memory leak occurs in the Linux kernel CAIF USB driver when caif_enroll_dev() fails after allocating link_support, leaving the pointer unassigned and unfreed.

Why it matters to the business

Repeated triggering on affected systems can slowly exhaust kernel memory, leading to degraded performance or crashes on Linux hosts using CAIF networking, with updates required across dependent packages like rpmlint on AlmaLinux 8.

How an attack unfolds

An attacker triggers CAIF device notification events under conditions that cause caif_enroll_dev() to fail, resulting in repeated allocation without release and gradual resource exhaustion; no named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade rpmlint on AlmaLinux 8 to version 1.10-14.el8 or later; apply the upstream kernel commit that frees the allocated link_support pointer on caif_enroll_dev() error paths.

How to confirm the fix worked

Confirm package version meets or exceeds the fixed release; inspect kernel source for the explicit kfree on enrollment failure in cfusbl_device_notify.

Typical attack path

1. Cause repeated CAIF USB device notifications
2. Induce failure in caif_enroll_dev() enrollment
3. Accumulate unfreed link_support allocations over time

How to detect it

Review kernel logs and memory profiling for repeated allocations tied to CAIF structures without corresponding frees; no widespread exploitation artifacts reported given the CVE's age and low EPSS trend.

What your security team should do

• Apply the AlmaLinux 8 package update without delay despite low EPSS and absence from KEV
• Audit environments for any CAIF USB usage and monitor kernel memory statistics
• Prioritize patching in high-uptime or networked systems where device events are possible