CVE-2021-47490

What it actually does

The flaw is a memory leak in the TTM subsystem where fences associated with ghost objects are not released, allowing repeated allocation without corresponding cleanup.

Why it matters to the business

Over time, systems may experience gradual memory exhaustion leading to degraded performance or denial of service on graphics-intensive workloads, though the low exploit probability and lack of active campaigns reduce immediate operational risk.

How an attack unfolds

An attacker triggers repeated operations that create ghost objects in the TTM layer without proper fence cleanup, slowly consuming kernel memory until the system becomes unstable or crashes.

How to fix it

Apply the upstream fix that adds fence cleanup for ghost objects in ttm_transfered_destroy; update to a kernel release containing commit resolving the leak.

How to confirm the fix worked

Verify the presence of the fence cleanup logic in ttm_transfered_destroy after patching; monitor kernel memory statistics under load to confirm no ongoing leakage from ghost objects.

Typical attack path

1. Identify a workload or application that exercises DRM/TTM ghost object creation paths
2. Repeatedly trigger object transfer or destruction sequences that bypass fence cleanup
3. Monitor kernel memory usage to confirm gradual leakage
4. Continue until memory pressure causes system instability or OOM conditions

How to detect it

Examine kernel logs and memory usage metrics for sustained growth without corresponding process activity; look for repeated TTM object operations in ftrace or perf traces on systems with DRM enabled.

What your security team should do

• Prioritize kernel updates for systems running affected DRM/TTM code paths within standard maintenance windows
• Enable kernel memory accounting and monitoring to detect anomalous growth
• Review graphics driver usage patterns for high-frequency object creation that could accelerate leakage