CVE-2021-47298

What it actually does

Potential memory leak in BPF sockmap when skb_linearize fails on error path, leaving msg block unfreed before returning error.

Why it matters to the business

Gradual kernel memory exhaustion on affected Linux systems under rare error conditions, risking instability or denial of service during prolonged operation.

How an attack unfolds

An attacker would craft network traffic or BPF programs to trigger the specific skb_linearize failure in sockmap handling; the leak accumulates over repeated triggers but the error case is unlikely and no public exploitation is known.

How to fix it

Update to a Linux kernel version containing the fix that adds kfree for the msg block before error return in bpf sockmap code.

How to confirm the fix worked

Review kernel source or changelog for the kfree addition in sockmap error handling; monitor kernel memory usage under synthetic error conditions to confirm no leak.

Typical attack path

1. Identify or control a system using BPF sockmap.
2. Trigger conditions causing skb_linearize to fail in the error path.
3. Repeat to accumulate leaked memory blocks leading to resource pressure.

How to detect it

Search kernel logs and memory accounting tools for unusual allocation growth in BPF or networking subsystems; no specific post-exploitation artifacts are known due to the theoretical nature of the leak.

What your security team should do

• Prioritize kernel updates on systems using BPF sockmap features.
• Monitor for upstream stable kernel releases addressing this issue.
• Audit custom BPF programs and sockmap usage for exposure to the error path.