CVE-2021-47365

What it actually does

Unreleased page reference acquired during afs_extend_writeback() loop causes memory pages to remain allocated after early loop exit, resulting in gradual RAM exhaustion.

Why it matters to the business

Systems using the AFS filesystem may experience progressive memory depletion, leading to reduced performance, increased swapping, or eventual system instability requiring reboots.

How an attack unfolds

An attacker with local access or the ability to trigger writeback operations on an AFS-mounted filesystem repeatedly invokes the faulty writeback path, causing the page reference leak to accumulate until memory pressure forces denial of service.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the page reference handling in afs_extend_writeback(); apply the latest stable kernel package for the distribution in use and reboot affected systems.

How to confirm the fix worked

Verify the running kernel version includes the afs page leak resolution; monitor resident memory usage during AFS writeback workloads and confirm no unexplained growth after applying the update.

Typical attack path

1. Mount or access an AFS filesystem
2. Trigger writeback operations via file writes or sync calls
3. Force early loop exit conditions in afs_extend_writeback()
4. Repeat to amplify unreleased page references
5. Observe system-wide memory exhaustion

How to detect it

Monitor system memory statistics and process RSS over time during AFS activity; correlate unexplained memory growth with AFS writeback operations in kernel logs or performance counters.

What your security team should do

• Prioritize kernel updates on all systems mounting AFS filesystems
• Enable memory usage monitoring and alerting for AFS-related processes
• Review and restrict local access where possible until patched
• Test the update in a non-production environment before broad deployment