CVE-2021-47488

What it actually does

Missing call to cgroup_bpf_offline during cgroup unmount leaves percpu_ref data allocated by cgroup_bpf_inherit in cgroup_setup_root unfreed, producing a permanent 64-byte kernel memory leak per mount/umount cycle when CONFIG_CGROUP_BPF is enabled.

Why it matters to the business

Repeated mount and unmount operations on cgroups gradually exhaust kernel memory, eventually causing system instability or requiring reboots on long-running Linux systems that rely on cgroup hierarchies.

How an attack unfolds

An attacker or automated process repeatedly mounts and unmounts a named cgroup hierarchy; each cycle allocates but never releases the percpu_ref backing store, steadily consuming kernel memory until the system becomes unresponsive or crashes.

How to fix it

Upgrade the Linux kernel to a version containing the fix: Debian 11 users to 5.10.84-1 or later, Debian 12 and 13 users to 5.15.3-1 or later. Reboot after package installation to load the corrected kernel.

How to confirm the fix worked

After patching, repeat the mount/umount sequence while running kmemleak scan; confirm no new unreferenced cgroup_bpf objects appear. Verify kernel version matches or exceeds the fixed package listed for the distribution.

Typical attack path

1. Obtain ability to execute mount/umount operations (local user, container escape, or scripted workload)
2. Repeatedly issue mount -t cgroup -o none,name=... followed by umount on the same path
3. Observe progressive kernel memory consumption via kmemleak or slabinfo until OOM or reboot occurs

How to detect it

Review kmemleak reports for objects allocated in cgroup_bpf_inherit and freed only on umount; correlate with audit logs showing repeated mount syscalls on cgroup filesystems.

What your security team should do

• Apply the listed fixed kernel packages immediately on all affected Debian systems
• Prioritize systems that frequently create or destroy cgroup namespaces
• Add kernel version checks to vulnerability scanning and asset inventory
• Monitor kmemleak or slabtop for unexpected cgroup-related allocations