CVE-2021-47516: nfp: Fix memory leak in nfp_cpp_area_cache_add()
In the Linux kernel, the following vulnerability has been resolved:
nfp: Fix memory leak in nfp_cpp_area_cache_add()
In line 800 (#1), nfp_cpp_area_alloc() allocates and initializes a
CPP area structure. But in line 807 (#2), when the cache is allocated
failed, this CPP area structure is not freed, which will result in
memory leak.
We can fix it by freeing the CPP area when the cache is allocated
failed (#2).
792 int nfp_cpp_area_cache_add(struct nfp_cpp *cpp, size_t size)
793 {
794 struct nfp_cpp_area_cache *cache;
795 struct nfp_cpp_area *area;
800 area = nfp_cpp_area_alloc(cpp, NFP_CPP_ID(7, NFP_CPP_ACTION_RW, 0),
801 0, size);
// #1: allocates and initializes
802 if (!area)
803 return -ENOMEM;
805 cache = kzalloc(sizeof(*cache), GFP_KERNEL);
806 if (!cache)
807 return -ENOMEM; // #2: missing free
817 return 0;
818 }
Security readout for executives and security teams
Plain-English summary
CVE-2021-47516 is a Linux kernel memory leak in nfp_cpp_area_cache_add(). If one allocation succeeds and the next fails, the first allocation is not freed. This is primarily an availability and resource-management issue, not a documented data-theft or remote-code-execution issue in the provided sources.
Executive priority
Handle through normal kernel patch management unless the nfp driver is in active use on sensitive or availability-critical systems. There is no source-backed evidence of active exploitation or severe impact, but kernel memory leaks still merit timely remediation.
Technical view
The vulnerable path allocates an nfp_cpp_area with nfp_cpp_area_alloc(), then returns -ENOMEM if kzalloc() for the cache fails without freeing the area. The kernel fix frees the CPP area on the allocation-failure path. The sources list Linux kernel affected versions and stable kernel commit references.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions where the nfp driver code is present and reachable. The provided sources do not prove broad default exposure, remote reachability, or exploitation in common deployments.
Exploitation context
The source bundle does not cite active exploitation, public exploit use, KEV listing, or a practical attack path. The bug requires an allocation-failure condition in a specific kernel driver path, so real-world exploitability is unclear from the available evidence.
Researcher notes
The key issue is a missing free on the kzalloc failure path after nfp_cpp_area_alloc(). Evidence is limited to the CVE description, affected Linux version metadata, and stable kernel commit references; no CVSS, CWE, exploit, or operational trigger details are provided.
Mitigation direction
Update to a Linux kernel containing the referenced stable fixes.
Use vendor or distribution kernel advisories to identify the corrected package version.
Prioritize systems that include or use the nfp driver path.
Track this as availability hardening unless new exploitation evidence appears.
Validation and detection
Inventory Linux kernel versions against the affected version data in the CVE record.
Confirm whether the nfp driver is built, packaged, or used on relevant systems.
Verify kernel source or vendor package includes one of the referenced stable fixes.
Check vulnerability scanner findings against distribution backport notes.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2021-47516 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.