CVE-2021-47190

What it actually does

perf_env__insert_btf() fails to free allocated BTF objects when a duplicate ID prevents insertion, resulting in a kernel memory leak.

Why it matters to the business

Repeated triggering can gradually exhaust kernel memory, potentially leading to performance degradation or system instability in environments using perf with BPF tracing.

How an attack unfolds

An attacker with sufficient privileges to invoke perf and load or reference BTF data triggers duplicate BTF ID paths, causing the kernel to allocate without releasing memory on each failed insertion.

How to fix it

Update the Linux kernel to a version containing the fix for perf_env__insert_btf that returns an error code and frees memory on duplicate insertion failure.

How to confirm the fix worked

Confirm kernel version includes the perf bpf BTF insertion error handling change; monitor for absence of memory growth under repeated perf/BPF duplicate ID workloads.

Typical attack path

1. Obtain local access or privileges to run perf commands or BPF programs
2. Cause repeated calls to perf_env__insert_btf with duplicate BTF identifiers
3. Accumulate unreleased kernel memory allocations over multiple invocations

How to detect it

Inspect kernel memory statistics and perf/BPF related process activity for unexpected sustained allocations; review audit logs for repeated perf invocations involving BTF data.

What your security team should do

• Prioritize kernel updates on systems using perf with BPF features
• Review and restrict unprivileged perf and BPF usage where possible
• Monitor memory usage trends on perf/BPF-enabled hosts