CVE-2021-47170

What it actually does

The kernel emits a warning from the memory allocator when usbfs receives an excessively large buffer request for bulk, asynchronous, or isochronous USB transfers, even though the request is rejected safely.

Why it matters to the business

Produces noisy kernel warnings that can obscure genuine issues, increase log volume, and complicate troubleshooting on systems exposing usbfs to untrusted users; low actual risk given the stable low EPSS and absence from KEV.

How an attack unfolds

An attacker submits an oversized transfer request through usbfs; the kernel correctly rejects it but triggers a warning from the MM subsystem. The listed threat actors reference unrelated privilege-escalation CVEs and do not apply here.

How to fix it

Apply the upstream fix that adds __GFP_NOWARN to the relevant kmalloc calls in drivers/usb/core/devio.c; rebuild and deploy the patched kernel. No specific fixed versions were supplied in the source data.

How to confirm the fix worked

Confirm the __GFP_NOWARN flag is present on the kmalloc sites for usbfs bulk, async, and isochronous buffers; re-test with an oversized allocation request and verify no warning is emitted.

Typical attack path

1. Open a usbfs device file
2. Prepare a transfer URB or isochronous descriptor table with an excessively large length
3. Submit the request via ioctl
4. Observe the resulting kernel warning in logs

How to detect it

Search kernel logs for warnings originating from usbfs memory-allocation paths; no public exploitation artifacts are known for this issue.

What your security team should do

• Prioritize kernel updates on systems that expose usbfs to unprivileged users
• Monitor kernel logs for usbfs-related allocation warnings as a defense-in-depth signal
• Restrict usbfs access via permissions or cgroup controls where feasible