CVE-2021-47122

What it actually does

Memory leak in error path of caif_device_notify when caif_enroll_dev fails to assign the allocated link_support pointer, leaving the allocation unreferenced.

Why it matters to the business

Long-term memory exhaustion on systems repeatedly triggering the error condition, potentially leading to degraded performance or service disruption; low exploitability and absence from known campaigns reduce urgency despite the age of the issue.

How an attack unfolds

An attacker would need to trigger repeated caif device enrollment failures to accumulate leaked memory until system impact occurs; no named threat actors or ransomware use have been observed.

How to fix it

Update python3-justbases to 0.14-4.el8 and python3-justbytes to 0.14-2.el8 on AlmaLinux 8; apply equivalent kernel fixes containing the caif_device_notify error-path free.

How to confirm the fix worked

Confirm package versions match the listed fixed releases and verify the memory-leak fix patch is present in the running kernel source or binary.

Typical attack path

1. Trigger conditions that cause caif_enroll_dev to fail after link_support allocation
2. Repeat the failure scenario to accumulate unreleased memory
3. Monitor for gradual memory pressure or OOM events

How to detect it

Search kernel or system logs for repeated caif_enroll_dev failures or unexplained memory growth patterns; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize upgrade of the two affected AlmaLinux packages to the stated fixed versions
• Monitor memory usage on systems using CAIF networking for unexplained growth
• Review EPSS and KEV status periodically as new exploitation data emerges