CVE-2021-47538

What it actually does

Reference leak on rxrpc_local object during peer candidate creation in rxrpc_lookup_peer, causing the object to be freed without releasing its internal reference and leading to eventual memory corruption or exhaustion.

Why it matters to the business

Kernel memory leaks in network subsystems can degrade system stability, increase resource consumption on servers and devices running affected Linux kernels, and raise operational costs for large-scale deployments with high network peer activity.

How an attack unfolds

An attacker triggers repeated rxrpc peer lookups through crafted network traffic or local RPC operations, causing the kernel to allocate rxrpc_local objects without properly decrementing their reference counts; over time this exhausts memory or creates conditions for use-after-free when objects are later accessed.

How to fix it

Update the Linux kernel to the fixed commit 219d54332a09e8d8741c1e1982f5eae56099de85 or later; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Confirm the presence of commit 219d54332a09e8d8741c1e1982f5eae56099de85 in the kernel source tree and verify that rxrpc_put_local is invoked before any peer structure kfree in rxrpc_lookup_peer and related freeing functions.

Typical attack path

1. Establish network conditions or local context that invokes rxrpc_lookup_peer
2. Force allocation of peer candidate structures holding rxrpc_local references
3. Trigger the buggy kfree path that omits rxrpc_put_local
4. Repeat to accumulate leaked references until memory pressure or corruption occurs

How to detect it

Review kernel logs for repeated rxrpc peer allocation warnings, monitor slab or kmem_cache usage growth for rxrpc_local objects, and inspect network traffic patterns that trigger RxRPC peer lookups.

What your security team should do

• Prioritize kernel upgrades on systems exposing rxrpc or RxRPC network services
• Monitor memory usage and peer creation rates on affected hosts until patched
• Apply the fix in all downstream distributions and embedded builds promptly