CVE-2021-47546

What it actually does

Memory leak in the ip6_dst_cache slab cache triggered when an IPv6 nftables fib rule and a suppress_prefixlength routing rule are both active, causing an allocation to be retained on every incoming IPv6 packet due to incorrect refcount handling in fib6_rule_suppress.

Why it matters to the business

Prolonged operation under the affected configuration leads to gradual memory exhaustion on Linux systems handling IPv6 traffic, potentially causing performance degradation or system instability in network devices, servers, and containers.

How an attack unfolds

An attacker sends repeated IPv6 packets to a system that has both an nftables prerouting fib rule checking saddr/mark/iif/oif and an ip -6 rule with suppress_prefixlength; each packet triggers the leak path in fib6_rule_suppress because the protocol-specific RT6_LOOKUP_F_DST_NOREF flag is not checked, steadily consuming memory until the system is impacted.

How to fix it

Apply the upstream kernel fix that passes protocol-specific flags to fib6_rule_suppress and checks RT6_LOOKUP_F_DST_NOREF before decrementing the refcount; rebuild and deploy the corrected kernel image.

How to confirm the fix worked

After patching, reproduce the nftables and ip-rule configuration, send IPv6 traffic, and confirm that slabtop shows stable ip6_dst_cache usage with no net growth over time.

Typical attack path

1. Deploy nftables IPv6 fib rule in prerouting chain
2. Add IPv6 routing rule with suppress_prefixlength 0
3. Send continuous stream of IPv6 packets matching the rule set
4. Observe unbounded growth in ip6_dst_cache allocations

How to detect it

Monitor slabtop or /proc/slabinfo for continuous growth in ip6_dst_cache on IPv6-enabled systems; review nftables rulesets and ip -6 rule output for the combination of fib saddr/mark/iif/oif checks and suppress_prefixlength entries; examine kernel logs for repeated allocation patterns under network load.

What your security team should do

• Identify all Linux hosts using IPv6 nftables fib rules together with suppress_prefix routing rules
• Prioritize patching kernel versions containing the faulty ca7a03c41753 change
• Add monitoring for ip6_dst_cache slab growth in production IPv6 environments
• Test the combination of nftables fib and ip-rule suppress configurations in staging before rollout