CVE-2021-47236

What it actually does

Memory leak in the CDC EEM USB Ethernet driver where skb_copy_expand failure in eem_tx_fixup leaves the original skb unfreed by usbnet_start_xmit, causing gradual kernel memory exhaustion on transmit paths.

Why it matters to the business

Linux systems using CDC EEM-based USB network adapters may experience progressive memory depletion under sustained network load, potentially leading to performance degradation or system instability; low exploitation likelihood reduces urgency despite widespread kernel presence.

How an attack unfolds

An attacker with local or network-adjacent access to a vulnerable Linux system triggers repeated USB network transmit operations that force skb_copy_expand failures in eem_tx_fixup, accumulating unfreed skbs until memory pressure causes denial of service; no named threat actors or ransomware campaigns are associated.

How to fix it

Apply the upstream kernel commit that frees the original skb before checking the clone result in eem_tx_fixup; upgrade to a Linux kernel version released after May 2021 that includes the fix for this memory leak.

How to confirm the fix worked

Confirm the eem_tx_fixup function contains the corrected skb free-before-check logic; test by forcing skb_copy_expand failure paths under load and monitoring for skb leaks via slabinfo or kmemleak.

Typical attack path

1. Identify Linux host using CDC EEM USB Ethernet interface
2. Generate network traffic that exercises usbnet transmit path
3. Induce skb allocation pressure to cause skb_copy_expand failures
4. Repeat to accumulate leaked skbs and exhaust kernel memory

How to detect it

Review kernel logs for repeated eem_tx_fixup or usbnet transmit errors; inspect memory usage trends via slabtop or kmemleak reports on systems with CDC EEM interfaces; no public exploit artifacts or threat actor TTPs are known.

What your security team should do

• Prioritize kernel updates on systems with CDC EEM USB networking
• Monitor EPSS and exploit maturity for any future changes
• Audit USB network device usage in environments to scope exposure