CVE-2021-47295 – This vulnerability is a memory leak in the Linu... (How to Fix)

Q: What is the severity of CVE-2021-47295?

CVE-2021-47295 has a CVSS score of 7.5 (HIGH). This vulnerability is a memory leak in the Linux kernel's traffic control subsystem. It allows attackers to cause denial of service by exhausting kernel memory resources. Systems running affected Linux kernel versions with traffic control (tc) configurations are vulnerable.

📋 TL;DR

This vulnerability is a memory leak in the Linux kernel's traffic control subsystem. It allows attackers to cause denial of service by exhausting kernel memory resources. Systems running affected Linux kernel versions with traffic control (tc) configurations are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but patches exist for multiple stable branches

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when traffic control (tc) subsystem is configured and used. Requires CAP_NET_ADMIN capability to trigger.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory exhaustion leading to system crash, instability, or denial of service affecting all processes.

🟠

Likely Case

Gradual performance degradation and potential system instability under specific traffic control operations.

🟢

If Mitigated

Minimal impact if traffic control features are not used or memory limits are enforced.

🌐 Internet-Facing: LOW - Requires local access or ability to modify traffic control settings.

🏢 Internal Only: MEDIUM - Local users or processes with CAP_NET_ADMIN can trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and CAP_NET_ADMIN capability. Memory leak can be triggered through tcindex operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 01d0d2b8b4e3cf2110baba9371c0c3d04ad5c77b, 18c3fa7a7fdbb4d21dafc8a7710ae2c1680930f6, 372ae77cf11d11fb118cbe2d37def9dd5f826abd, 3abebc503a5148072052c229c6b04b329a420ecd, 53af9c793f644d5841d84d8e0ad83bd7ab47f3e0

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Restrict CAP_NET_ADMIN

linux

Limit which users/processes have CAP_NET_ADMIN capability to reduce attack surface

# Review current capabilities: getcap /usr/sbin/tc
# Remove CAP_NET_ADMIN: setcap -r /usr/sbin/tc

Disable traffic control features

linux

Avoid using tcindex classifier in traffic control configurations

# Check current tc configurations: tc filter show
# Remove tcindex filters if present

🧯 If You Can't Patch

Implement strict access controls to limit CAP_NET_ADMIN capability
Monitor system memory usage and kernel logs for signs of memory exhaustion

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if traffic control is configured: uname -r && tc filter show

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and check for memory leak patterns in /proc/meminfo and kernel logs

📡 Detection & Monitoring

Log Indicators:

Kernel oom-killer messages
Memory allocation failures in dmesg
High kernel memory usage in system logs

Network Indicators:

Unusual traffic control configuration changes

SIEM Query:

source="kernel" AND ("out of memory" OR "oom-killer" OR "memory allocation failure")

📊 Metadata

CVE ID: CVE-2021-47295

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-400

Published: May 21, 2024

Last Updated: December 6, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47295, you might also want to check these: