CVE-2021-47305

What it actually does

Missing dma_fence_put calls and kfree on error paths during sync_file fence merging allow dma_fence references and arrays to leak without cleanup.

Why it matters to the business

Repeated merge failures on dma-buf operations can slowly exhaust kernel memory, risking instability or denial of service on systems performing graphics, media, or inter-device synchronization; low exploitability indicators reduce immediate urgency.

How an attack unfolds

An attacker triggers dma-buf sync_file merge operations that hit error paths such as fence addition failures or realloc errors, causing the kernel to skip reference decrements and array frees, gradually depleting memory without direct code execution.

How to fix it

Update the Linux kernel to a version containing the fix that zero-initializes i and fences variables and ensures dma_fence_put plus kfree on every error path in sync_file.c.

How to confirm the fix worked

Confirm the presence of the upstream commit that adds proper cleanup on merge failure; inspect /proc/slabinfo or kmemleak reports for dma_fence object growth after exercising merge paths.

Typical attack path

1. Obtain or create dma-buf objects and fences
2. Invoke merge operations engineered to fail at add_fence or krealloc_array
3. Repeat the failing merge to accumulate leaked references
4. Observe progressive kernel memory pressure or OOM conditions

How to detect it

Examine kernel logs and slab allocator statistics for repeated dma_fence allocations without corresponding releases; review process activity involving dma-buf or sync_file syscalls during periods of unexplained memory growth.

What your security team should do

• Apply available kernel updates containing the referenced fix
• Monitor systems with heavy dma-buf usage for unexplained memory growth
• Limit untrusted access to dma-buf and sync_file interfaces where feasible