CVE-2021-47423

What it actually does

Memory leak in drm/nouveau/debugfs where single_open() allocates 'op' but single_release() is never called, leaving the allocation unreclaimed on file close.

Why it matters to the business

Gradual memory exhaustion on systems using the Nouveau driver when debugfs interfaces are accessed repeatedly, potentially leading to reduced stability or denial of service on long-running Debian Linux servers and workstations; low urgency given age and low exploit likelihood.

How an attack unfolds

An attacker with local access repeatedly opens the affected debugfs file entry; each open allocates memory via single_open() that is never freed because single_release() is omitted, allowing incremental consumption until system resources are depleted.

How to fix it

Upgrade linux packages on Debian 12 to version 6.1.64-1 or later and on Debian 13 to version 6.5.6-1 or later; rebuild and reboot into the fixed kernel; disable unnecessary Nouveau debugfs exposure if immediate patching is not feasible.

How to confirm the fix worked

Verify running kernel version matches or exceeds the listed fixed packages for the distribution; inspect source for single_release() calls after single_open() in nouveau debugfs code; run memory-leak stress tests that exercise the debugfs interface and confirm no growth in slab allocations.

Typical attack path

1. Identify a system running an affected Linux kernel with Nouveau enabled
2. Obtain local user access or a process capable of opening debugfs entries
3. Repeatedly open and close the vulnerable debugfs file descriptor
4. Monitor memory usage growth attributable to the kernel 'op' allocation
5. Continue until memory pressure causes instability or OOM events

How to detect it

Search kernel logs and memory accounting tools for repeated slab allocations tied to nouveau debugfs file operations; correlate high-frequency open/close events on debugfs entries with unexplained memory growth on affected kernels.

What your security team should do

• Apply the listed fixed kernel packages on all Debian 12 and 13 systems within standard maintenance windows
• Prioritize systems exposing Nouveau debugfs to untrusted local users
• Monitor EPSS and KEV updates for any future increase in exploitation activity
• Review internal usage of nouveau debugfs and restrict access where possible