CVE-2021-47537

What it actually does

Memory leak in rvu_mbox_init() when the default switch case is hit, because mbox_regions allocation is not released before returning an error instead of jumping to the cleanup label.

Why it matters to the business

On systems using the affected driver, repeated triggering of the error path can slowly exhaust kernel memory and degrade or crash the system over time.

How an attack unfolds

An attacker with local access triggers the specific error path in the mailbox initialization routine, causing the allocated region to be lost; the leak accumulates with each occurrence until memory pressure leads to denial of service.

How to fix it

Apply the upstream fix that replaces the direct return with a goto to the free_regions label, or upgrade to a Linux kernel version that contains the corrected octeontx2-af mailbox initialization code.

How to confirm the fix worked

Inspect the rvu_mbox_init() function in the running kernel source or binary to confirm the presence of the goto free_regions path on the default case; monitor kernel memory statistics before and after exercising the driver initialization under error conditions.

Typical attack path

1. Obtain local access on a system with CONFIG_OCTEONTX2_AF enabled
2. Cause the driver to enter rvu_mbox_init() and hit the default case error path
3. Repeat the triggering action to amplify the leak
4. Observe system memory exhaustion or forced reboot

How to detect it

Examine kernel logs and slab allocator statistics for unexpected growth in allocations tied to the octeontx2 mailbox region; correlate with driver load or error events indicating the default switch path was taken.

What your security team should do

• Prioritize kernel updates on any systems that load the octeontx2-af driver
• Review boot and driver load logs for repeated mailbox initialization failures that could indicate leak accumulation
• Consider disabling the driver module if the hardware is not in use