CVE-2021-47426

What it actually does

Failure to release allocated jit_data structure via kfree on error paths during BPF JIT compilation on s390 leads to a memory leak.

Why it matters to the business

Systems may experience gradual memory exhaustion over repeated BPF program loads that hit the error path, potentially causing performance degradation, out-of-memory conditions, or service disruptions in long-running environments.

How an attack unfolds

An attacker crafts BPF programs that trigger JIT compilation failures on s390 hardware; each failure leaks memory without recovery, allowing resource exhaustion through repeated attempts without needing code execution.

How to fix it

Upgrade the Linux kernel to a version containing the fix that ensures kfree is called on jit_data in the error path for s390 BPF JIT.

How to confirm the fix worked

Verify the running kernel includes the commit resolving the jit_data leak; review kernel source or changelog for the bpf s390 error-path kfree addition and test BPF program loading under error conditions.

Typical attack path

1. Identify or create conditions that force BPF JIT compilation errors on s390
2. Load multiple BPF programs designed to hit the faulty error path
3. Repeat loading to accumulate leaked memory allocations
4. Monitor for system-wide memory pressure or OOM events

How to detect it

Review system logs and memory statistics for unusual growth correlated with BPF program loads; inspect kernel traces or slab allocator statistics for unreleased jit_data objects.

What your security team should do

• Prioritize kernel updates on s390 systems that use BPF JIT
• Monitor memory usage trends on affected hosts during BPF activity
• Limit untrusted BPF program loading until patched