CVE-2021-47376

What it actually does

The flaw permits oversized allocations via kvcalloc in the BPF verifier's check_btf_line and check_btf_info paths without an upper-bound check, allowing kvmalloc_node to receive requests larger than kmalloc supports and emit a warning at mm/util.c:597.

Why it matters to the business

Unpatched kernels may log warnings or experience reduced stability when untrusted BPF programs are loaded, affecting systems that rely on eBPF for observability, networking, or security enforcement; the 881-day exposure window and static low EPSS indicate limited but persistent risk across the Linux ecosystem.

How an attack unfolds

An attacker prepares a BPF program containing an oversized BTF line array, invokes the bpf syscall to reach bpf_prog_load, passes through bpf_check, and triggers the unchecked kvcalloc in check_btf_info, causing the kernel to hit the oversized-allocation warning path.

How to fix it

Upgrade the kernel to a version that includes the oversize check before kvcalloc (commit referenced in the fix) in kernel/bpf/verifier.c; rebuild and reboot affected hosts.

How to confirm the fix worked

Confirm the patched verifier.c contains the size validation before kvcalloc_array; run BPF loading tests with large BTF payloads and verify absence of the mm/util.c:597 warning.

Typical attack path

1. Craft BPF program with excessively large BTF info
2. Call __x64_sys_bpf to load the program
3. Enter bpf_check and reach check_btf_info
4. Execute kvcalloc without size guard
5. Trigger WARNING in kvmalloc_node

How to detect it

Search kernel logs (dmesg, journalctl) for the string "WARNING: CPU" combined with "kvmalloc_node" and "bpf/verifier.c"; inspect failed bpf_prog_load attempts that reference check_btf_info.

What your security team should do

• Prioritize kernel updates on systems exposing unprivileged BPF
• Enable kernel lockdown or unprivileged_bpf_disabled sysctl where feasible
• Monitor kernel logs for kvmalloc warnings originating from bpf_check