CVE-2021-47294

What it actually does

Unbalanced socket reference counting in NET/ROM timer expiration handlers leaves kernel socket objects with elevated refcounts, preventing their release and creating a memory leak that can lead to use-after-free conditions.

Why it matters to the business

Systems relying on NET/ROM networking face gradual memory exhaustion or sudden kernel crashes that disrupt network services and require reboots, though the issue is uncommon outside specialized radio environments.

How an attack unfolds

An attacker creates NET/ROM sockets that activate timers via the sock timer API introduced in the referenced commit; when those timers expire the missing decrement leaves the socket refcount elevated, allowing repeated allocation to exhaust memory or trigger use-after-free on subsequent operations.

How to fix it

Apply the upstream fix that adds the required sock refcount decrement in the timer handler; upgrade to a kernel containing commit 63346650c1a9 plus the follow-up correction, or apply the equivalent distribution patch.

How to confirm the fix worked

Confirm the presence of the balancing decrement in the NET/ROM timer callback by inspecting kernel source or running a kernel version that lists the fix; test by creating and expiring multiple NET/ROM sockets while monitoring sock slab usage.

Typical attack path

1. Establish NET/ROM sockets and configure them to use timers
2. Allow or force timer expiration without closing sockets normally
3. Repeat socket creation to amplify the refcount imbalance
4. Trigger kernel memory pressure or socket reuse to surface the use-after-free

How to detect it

Review kernel logs for repeated NET/ROM socket allocation without corresponding release messages; watch for growing sock or sk_buff slab statistics over time on systems with NET/ROM enabled.

What your security team should do

• Prioritize patching on any system exposing NET/ROM interfaces
• Monitor kernel memory usage for unexpected growth in sock slabs
• Disable NET/ROM protocol if not required via kernel configuration