CVE-2021-47568

What it actually does

Unfixed memory leak in ksmbd's get_file_stream_info() causes repeated allocations without corresponding frees when handling SMB file stream metadata, leading to gradual kernel memory exhaustion.

Why it matters to the business

SMB file servers may experience progressive resource depletion, degraded performance, and eventual denial of service under sustained load, increasing operational costs and downtime risk for file-sharing workloads.

How an attack unfolds

An attacker interacts with a vulnerable ksmbd instance over SMB, issuing sequences of requests that invoke get_file_stream_info(); each invocation leaks memory that is never reclaimed, allowing slow accumulation until system resources are exhausted.

How to fix it

Update the Linux kernel to a version containing the upstream fix for the memleak in get_file_stream_info(); rebuild and deploy the patched kernel on all affected systems; where immediate patching is not feasible, restrict SMB exposure and monitor memory usage closely.

How to confirm the fix worked

Confirm the running kernel source contains the commit resolving the memleak in get_file_stream_info(); compare kernel version against distributions that backported the fix; test by exercising SMB stream operations while monitoring slab or kmalloc counters for leaks.

Typical attack path

1. Locate exposed or reachable ksmbd instances via network SMB discovery
2. Establish authenticated or unauthenticated SMB sessions
3. Send crafted requests that trigger repeated calls to get_file_stream_info()
4. Repeat the pattern over time to amplify memory consumption
5. Observe or trigger system instability once memory pressure becomes critical

How to detect it

Review kernel and SMB-related logs for repeated get_file_stream_info activity; correlate with gradual increases in kernel memory usage or slab allocator statistics on systems exposing ksmbd; look for SMB session patterns that coincide with unexplained memory growth.

What your security team should do

• Prioritize kernel updates on all systems running ksmbd
• Apply network segmentation or firewall rules to limit SMB exposure
• Implement memory usage monitoring and alerting for kernel processes handling SMB
• Review and harden SMB authentication and access controls as a compensating measure