CVE-2021-47417

What it actually does

Failure to free the outer strset struct after freeing its internal members causes a memory leak on repeated allocation paths in libbpf.

Why it matters to the business

Long-running processes or daemons that load many BPF programs can experience gradual memory growth, leading to performance slowdowns or out-of-memory conditions on affected Linux systems.

How an attack unfolds

An attacker with the ability to trigger repeated BPF object loading or strset operations causes the leak to accumulate until memory pressure forces denial of service; no remote code execution path is known.

How to fix it

Upgrade to a Linux kernel containing the fix that frees the strset struct itself; rebuild and redeploy any statically linked libbpf userspace components.

How to confirm the fix worked

Confirm the presence of the upstream commit that adds the missing free of the strset struct; run memory-leak detection tools such as valgrind or kmemleak while exercising BPF loading paths.

Typical attack path

1. Obtain local or unprivileged access sufficient to load BPF programs
2. Repeatedly create and destroy objects that exercise the strset allocation path
3. Monitor system memory until exhaustion produces observable impact

How to detect it

Review kernel or userspace memory accounting logs for sustained growth correlated with BPF program load events; examine coredumps or heap profiles for repeated unfreed strset allocations.

What your security team should do

• Prioritize kernel updates on systems that heavily use libbpf or eBPF tooling
• Monitor memory usage trends on long-lived BPF-enabled workloads
• Apply the fix during the next scheduled maintenance window if EPSS remains low