CVE-2021-47513

What it actually does

Resource leak in felix_setup_mmio_filtering when no CPU port is present, causing unreleased memory allocations in the DSA driver.

Why it matters to the business

Gradual memory exhaustion on affected Linux systems can lead to degraded performance, instability, or denial of service in network-heavy environments over extended uptime.

How an attack unfolds

An attacker with local access or the ability to influence device initialization triggers the felix MMIO filtering setup path without a defined CPU port, leaving allocated structures unreleased and accumulating leaks across repeated invocations or reboots.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix for the resource leak in felix_setup_mmio_filtering; apply the patch addressing Coverity IDs 1492897 and 1492899 if backporting is required.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or binary; monitor for absence of repeated resource allocation warnings during driver initialization in dmesg or kernel logs.

Typical attack path

1. Obtain local execution or configuration control on a system using the felix DSA driver
2. Ensure or force a setup scenario where no CPU port is defined during felix_setup_mmio_filtering
3. Trigger repeated driver initialization or module load paths to accumulate leaked memory
4. Observe system memory pressure leading to operational impact

How to detect it

Review kernel logs and dmesg for resource leak warnings tied to felix MMIO filtering; track kernel memory statistics for unexpected growth in driver-related allocations after driver initialization.

What your security team should do

• Prioritize kernel updates on all systems using the felix DSA driver
• Audit configurations to ensure CPU ports are always defined where the driver is active
• Implement memory usage monitoring to detect anomalous growth in kernel slab caches