CVE-2021-47125

What it actually does

Reference count leak in htb_parent_to_leaf_offload due to pointer inconsistency between dev_queue->qdisc and cl->parent->leaf.q after handling NULL new_q in HTB qdisc grafting.

Why it matters to the business

May cause gradual memory exhaustion or instability in network traffic shaping on Linux systems, with low immediate risk given age and low exploit probability.

How an attack unfolds

An attacker triggers HTB class operations that pass a NULL qdisc to graft helper, leaving mismatched pointers that leak references; no named threat actors or ransomware use reported.

How to fix it

Upgrade affected packages to the listed fixed versions: custodia 0.6.0-3.module_el8.6.0+2881+2f24dc92, python3-custodia 0.6.0-3.module_el8.6.0+2881+2f24dc92, python3-jwcrypto 0.5.0-1.module_el8.5.0+2603+92118e57, python3-pyusb 1.0.0-9.module_el8.5.0+2603+92118e57, python3-qrcode 5.1-12.module_el8.5.0+2603+92118e57, python3-qrcode-core 5.1-12.module_el8.6.0+2737+7e73ea90, python3-yubico 1.3.2-9.module_el8.6.0+2737+7e73ea90, python3-kdcproxy 0.4-5.module_el8.5.0+2603+92118e57; apply kernel updates that include the referenced commit.

How to confirm the fix worked

Verify package versions match the fixed releases above and confirm kernel source contains the NULL check in htb_parent_to_leaf_offload.

Typical attack path

1. Reach a system running an unpatched kernel with HTB qdisc configured
2. Perform network operations that invoke htb_graft_helper with NULL new_q
3. Exploit resulting refcount leak to degrade kernel resources over time

How to detect it

Review kernel logs for repeated HTB qdisc graft operations or refcount warnings; no specific post-exploitation artifacts known.

What your security team should do

• Prioritize patching systems with HTB qdisc usage
• Monitor EPSS and KEV updates for any rise in activity
• Test upgrades in staging before broad deployment given the 949-day publication age