CVE-2021-47295

What it actually does

Memory leak in tcindex classifier where tcindex_set_parms allocates new tcindex_data, copies fields but omits the perfect hash table, and tcindex_partial_destroy_work fails to release it, causing unbounded kernel memory growth under repeated updates.

Why it matters to the business

Networking systems using traffic classifiers can experience gradual memory exhaustion, leading to performance degradation, service disruption, or crashes on high-traffic or long-lived hosts; high prevalence of Linux kernels amplifies operational risk.

How an attack unfolds

An attacker sends repeated netlink configuration messages that invoke tcindex_set_parms to replace classifier parameters, each time allocating new structures without freeing the prior perfect hash, steadily consuming kernel memory until denial of service.

How to fix it

Apply the upstream fix that ensures tcindex_partial_destroy_work releases the perfect hash table; rebuild and deploy updated kernels across affected distributions.

How to confirm the fix worked

Inspect kernel source for the corrected tcindex_partial_destroy_work implementation that frees the hash; run syzkaller or targeted netlink fuzzing to confirm absence of leaks under repeated tcindex updates.

Typical attack path

1. Send crafted RTM_NEWQDISC or RTM_NEWTCLASS netlink messages targeting tcindex
2. Trigger multiple parameter updates via tcindex_set_parms to allocate without hash release
3. Repeat to accumulate leaked memory until kernel OOM or performance collapse

How to detect it

Review kernel logs and netlink audit records for high volumes of tcindex classifier modifications; correlate with slab or kmalloc memory growth in networking subsystems.

What your security team should do

• Prioritize kernel upgrades on any system exposing traffic control interfaces
• Monitor kernel memory statistics for tcindex-related growth
• Restrict unprivileged netlink access to qdisc configuration where feasible