CVE-2021-47539

What it actually does

Failure to decrement the reference count on an rxrpc_peer object held by a bundle candidate before calling kfree results in a kernel memory leak within the RXRPC subsystem.

Why it matters to the business

Over time the leak can exhaust kernel memory on systems handling RXRPC traffic, leading to degraded network performance, service instability, or crashes that disrupt operations.

How an attack unfolds

An attacker repeatedly triggers the rxrpc_look_up_bundle path with crafted RXRPC traffic to allocate bundles whose peer references are never released, gradually consuming memory until the system becomes unstable.

How to fix it

Apply the upstream fix that introduces rxrpc_put_peer before kfree in bundle cleanup and abstracts the freeing logic; upgrade to a kernel containing the resolution for CVE-2021-47539.

How to confirm the fix worked

Confirm the presence of the patch that calls rxrpc_put_peer on bundle candidates and verify no rxrpc_peer objects remain referenced after bundle kfree paths execute.

Typical attack path

1. Establish RXRPC connections that cause bundle candidate creation
2. Trigger rxrpc_look_up_bundle repeatedly without completing normal teardown
3. Accumulate leaked peer objects until memory pressure occurs
4. Induce kernel instability or denial of service

How to detect it

Examine kernel memory statistics and slab allocator usage for rxrpc_peer objects that increase without corresponding bundle deallocation; review audit logs for repeated RXRPC bundle operations under high connection churn.

What your security team should do

• Prioritize kernel updates on all systems using RXRPC or related network protocols
• Monitor memory usage trends on affected hosts for unexplained growth
• Review kernel changelog for the exact commit that resolves the leak