CVE-2021-47367

What it actually does

The flaw causes unused pages chained via private pointers in big mode to not be released after build_skb() succeeds due to sufficient tailroom, resulting in memory page leaks.

Why it matters to the business

Local memory leaks in virtualized network handling can lead to gradual resource exhaustion and potential exposure of sensitive kernel memory contents over time, increasing operational costs and risk in affected environments.

How an attack unfolds

An attacker with local access triggers virtio-net packet processing in big mode to force build_skb() usage while leaving chained pages unreleased, allowing repeated leaks that may disclose memory contents or degrade system stability.

How to fix it

Update to fixed kernel versions containing the virtio-net skb build fix; apply the referenced commits that release unused pages after building skb in big mode.

How to confirm the fix worked

Confirm kernel version includes the page release logic after build_skb in big mode; monitor for absence of page allocation warnings or leaks in virtio-net paths.

Typical attack path

1. Obtain local access to a system using virtio-net in big mode
2. Craft network traffic or driver interactions to invoke skb building with sufficient tailroom
3. Trigger the code path that forgets to release private chained pages
4. Repeat to accumulate leaks for memory disclosure or DoS

How to detect it

Review kernel logs for virtio-net page allocation anomalies or unreleased page warnings; inspect memory usage patterns in virtual network interfaces post-publication date.

What your security team should do

• Prioritize patching Linux kernels using virtio-net drivers
• Monitor EPSS and revisit if trend increases
• Audit virtualized environments for memory leak symptoms