CVE-2021-47320

What it actually does

The vulnerability is a memory leak of posix_acl structures (acl and default_acl) that occurs in the error paths of nfs3_proc_create() and nfs3_proc_mknod() within the Linux kernel NFS client implementation.

Why it matters to the business

Repeated NFS file creation or mknod operations that hit error conditions can gradually exhaust kernel memory on affected systems, leading to performance degradation, instability, or crashes in environments that rely on NFS for file sharing.

How an attack unfolds

An attacker with access to an NFS mount triggers error conditions during file creation or device node creation operations, causing the kernel to allocate ACL memory that is never freed on those error paths, resulting in cumulative memory loss over many attempts.

How to fix it

Update the Linux kernel to a version that includes the fix resolving the ACL memory leak in the NFS error paths of nfs3_proc_create() and nfs3_proc_mknod().

How to confirm the fix worked

Confirm the kernel source contains the referenced NFS ACL fix commit, verify the patched kernel version is running, and exercise NFS create/mknod error paths under memory monitoring to ensure no leaks occur.

Typical attack path

1. Mount or access an NFS export from a Linux client
2. Issue create or mknod operations engineered to fail at specific points in nfs3_proc_create or nfs3_proc_mknod
3. Repeat the failing operations to trigger repeated ACL allocations without corresponding frees
4. Observe progressive kernel memory consumption until system impact occurs

How to detect it

Review kernel and NFS logs for repeated create or mknod error entries; correlate with system memory statistics showing unexplained growth in the NFS client code paths; examine slab allocator statistics for posix_acl objects.

What your security team should do

• Prioritize kernel updates on all systems acting as NFS clients
• Apply the fix before the next scheduled maintenance window given the 882 days since publication
• Monitor kernel memory usage statistics on NFS-dependent hosts
• Limit NFS access to trusted clients until patching is complete