CVE-2021-47555

What it actually does

Reference count underflow on a VLAN real_dev due to dev_put called in vlan_dev_free without a preceding dev_hold in register_vlan_dev, resulting in negative refcounts, memory leak warnings, and infinite unregister_netdevice loops.

Why it matters to the business

Linux systems using VLAN interfaces may experience repeated kernel warnings, memory accounting failures, and stalled network device cleanup that can degrade or interrupt network operations until the kernel is updated.

How an attack unfolds

An attacker with local access creates a dummy netdevice, attaches a VLAN sub-interface, then removes the dummy device; the missing hold leaves the real_dev refcount unbalanced so that subsequent put operations underflow and trigger the warning and unregister loop.

How to fix it

Upgrade the Linux kernel to the commit 8bb7eca972ad531c9b149c0a51ab43a417385813 or any later mainline or distribution release that contains the fix; rebuild and reboot with the corrected kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 8bb7eca972ad531c9b149c0a51ab43a417385813 or verify that the dev_hold call for real_dev now resides inside vlan_dev_init; re-execute the original testcase and ensure no refcount warnings or negative usage counts appear.

Typical attack path

1. Create a dummy netdevice
2. Attach a VLAN interface to the dummy device
3. Delete the dummy netdevice
4. Observe refcount underflow warning and unregister_netdevice loop

How to detect it

Search kernel logs and dmesg for refcount underflow warnings and unregister_netdevice messages mentioning negative usage counts; correlate with processes that performed ip link add/del operations involving VLANs.

• refcount_t: decrement hit 0; leaking memory.
• unregister_netdevice: waiting for .* to become free. Usage count = -

What your security team should do

• Apply the referenced kernel commit or distribution update to all affected systems as soon as possible
• Scan logs for the strings 'refcount_t: decrement hit 0' and 'unregister_netdevice: waiting for' to identify prior occurrences
• Limit unprivileged creation of dummy and VLAN devices via network namespace or capability controls until patched