CVE-2021-47467: kunit: fix reference count leak in kfree_at_end
In the Linux kernel, the following vulnerability has been resolved:
kunit: fix reference count leak in kfree_at_end
The reference counting issue happens in the normal path of
kfree_at_end(). When kunit_alloc_and_get_resource() is invoked, the
function forgets to handle the returned resource object, whose refcount
increased inside, causing a refcount leak.
Fix this issue by calling kunit_alloc_resource() instead of
kunit_alloc_and_get_resource().
Fixed the following when applying:
Shuah Khan <skhan@linuxfoundation.org>
CHECK: Alignment should match open parenthesis
+ kunit_alloc_resource(test, NULL, kfree_res_free, GFP_KERNEL,
(void *)to_free);
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue is a resource-management bug in KUnit, the kernel testing framework. A reference count can leak during normal kfree_at_end() handling, potentially reducing availability. The supplied sources do not show data exposure, integrity impact, active exploitation, or a production workload trigger.
Executive priority
Handle through normal kernel patch governance, with moderate priority for availability-sensitive environments. There is no cited active exploitation or confidentiality impact, but kernel maintenance should not ignore refcount leaks because they can accumulate into reliability problems.
Technical view
kfree_at_end() used kunit_alloc_and_get_resource(), which increments a resource reference count. The returned resource was not handled, causing a refcount leak. The fix changes this path to kunit_alloc_resource(), avoiding the extra reference. CVSS is 5.3 with availability-only impact.
Likely exposure
Exposure is most relevant to Linux kernels in the affected version range or commit lineage that include the vulnerable KUnit code. The source bundle lists Linux kernel 5.14, 5.14.15, 5.15, and commit 1d71307a6f94. Evidence for broad production exposure is incomplete.
Exploitation context
No source in the bundle reports active exploitation, and the CVE is not listed as KEV. The available description is a kernel resource leak, not a demonstrated exploit chain. Treat it as an availability-risk maintenance item unless vendor guidance indicates higher operational exposure.
Researcher notes
The issue is narrowly described as a KUnit refcount leak in kfree_at_end(). The source evidence supports the root cause and fix direction but does not provide exploitability details, affected distribution packages, or operational trigger conditions. Validate against exact kernel source history before scoring local risk.
Mitigation direction
Update affected Linux kernels to versions containing the referenced stable fixes.
Check Linux distribution advisories for packaged kernel backports and exact fixed builds.
Prioritize systems where KUnit is enabled or kernel test paths run regularly.
Avoid inventing local mitigations; follow kernel or distribution vendor guidance.
Validation and detection
Inventory kernel versions and compare them with vendor fixed-version guidance.
Review whether KUnit is built or enabled in relevant kernel configurations.
Confirm the referenced stable commits are present in your kernel source or package changelog.
Track distribution advisories for CVE-2021-47467 remediation status.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2021-47467 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.