CVE-2021-47538

Q: What is the severity of CVE-2021-47538?

CVE-2021-47538 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's rxrpc subsystem. When the kernel fails to properly release a local reference in the rxrpc_lookup_peer() function, it can lead to resource exhaustion. This affects systems running vulnerable Linux kernel versions with the rxrpc module loaded.

5.5 MEDIUM

Denial of Service

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's rxrpc subsystem. When the kernel fails to properly release a local reference in the rxrpc_lookup_peer() function, it can lead to resource exhaustion. This affects systems running vulnerable Linux kernel versions with the rxrpc module loaded.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable kernel versions referenced in the git commits (need to check which kernel releases contain these commits)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if rxrpc module is loaded/used. Many distributions don't load this module by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could lead to kernel memory exhaustion, causing system instability, denial of service, or potential kernel crashes.

🟠

Likely Case

Memory leak gradually consumes kernel resources, potentially leading to performance degradation or system instability over time.

🟢

If Mitigated

With proper monitoring and resource limits, impact is limited to potential performance issues rather than complete system failure.

🌐 Internet-Facing: LOW - This requires local access or ability to trigger specific kernel functions, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or processes could potentially trigger the memory leak, affecting system stability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to trigger rxrpc functionality and local access. Memory leaks are generally harder to weaponize than direct code execution vulnerabilities.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the referenced git commits: 3e70e3a72d80b16094faccbe438cd53761c3503a and related commits

Vendor Advisory: https://git.kernel.org/stable/c/3e70e3a72d80b16094faccbe438cd53761c3503a

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check with your distribution for specific patched kernel packages. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Unload rxrpc module

linux

If rxrpc functionality is not needed, unload the module to prevent vulnerability exposure

sudo rmmod rxrpc

Blacklist rxrpc module

linux

Prevent rxrpc module from loading automatically

echo 'blacklist rxrpc' | sudo tee /etc/modprobe.d/blacklist-rxrpc.conf

🧯 If You Can't Patch

Monitor kernel memory usage and system stability metrics
Implement strict access controls to limit who can trigger rxrpc functionality

🔍 How to Verify

Check if Vulnerable:

Check if rxrpc module is loaded: lsmod | grep rxrpc. If loaded, check kernel version against affected versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to one containing the fix commits, and confirm rxrpc module behavior doesn't cause memory leaks.

📡 Detection & Monitoring

Log Indicators:

Kernel oom-killer events
System instability logs
Memory pressure warnings in dmesg

Network Indicators:

Unusual rxrpc traffic patterns if module is in use

SIEM Query:

source="kernel" AND ("out of memory" OR "oom-killer" OR "memory pressure")

📊 Metadata

CVE ID: CVE-2021-47538

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

Published: May 24, 2024

Last Updated: September 18, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Unload rxrpc module

Blacklist rxrpc module

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities