CVE-2021-47128 is a vulnerability in the Linux kernel related to the implementation of SELinux lockdown permission checks, specifically affecting the Berkeley Packet Filter (BPF) subsystem. The vulnerability stems from a flawed implementation of the locked_down Linux Security Module (LSM) hook within SELinux, introduced by commit 59438b46471a. This hook was designed to restrict operations that could breach lockdown policies, including those triggered by audit subsystem events. However, the interaction between SELinux lockdown checks and the audit subsystem can cause severe system stability issues, including out-of-memory (OOM) kills and deadlocks. The deadlock arises from a circular locking dependency involving the run queue lock (rq_lock), the audit daemon (kauditd), and SELinux permission checks during BPF program execution triggered by tracepoints such as trace_sched_switch(). Additionally, the SELinux policy enforcement is broken for BPF programs because the lockdown permission check is performed against the 'current' task context (e.g., an unrelated application like httpd making a syscall) rather than the actual entity installing the BPF program (e.g., bpftrace). This misalignment means that legitimate BPF tracing programs may be incorrectly denied permissions unless the policy is impractically written against unrelated processes. The fix involves moving the lockdown permission check from the BPF helper fast-path (called millions of times per second) to the BPF program verification phase, where the actual task installing the BPF program can be accurately identified. This approach prevents the OOM and deadlock issues and aligns enforcement with other lockdown checks performed at open/load time. This vulnerability affects Linux kernel versions containing the problematic commit and impacts systems using SELinux lockdown with BPF tracing tools such as bpftrace, BCC, perf, and systemtap. While no known exploits are reported in the wild, the vulnerability can cause denial-of-service conditions and potentially disrupt critical monitoring and tracing operations.

For European organizations, this vulnerability poses a significant risk primarily to systems running Linux kernels with SELinux lockdown enabled and utilizing BPF-based tracing or monitoring tools. The impact includes potential system instability due to OOM kills and deadlocks, leading to denial of service on critical infrastructure, servers, or endpoints. Organizations relying on BPF for performance monitoring, security auditing, or troubleshooting may experience disruptions or loss of visibility, impairing incident response and operational continuity. Given the widespread use of Linux in enterprise servers, cloud environments, and embedded systems across Europe, the vulnerability could affect sectors such as finance, telecommunications, government, and critical infrastructure. The deadlock and OOM conditions could also be exploited to cause targeted disruptions or as part of a broader attack chain. However, exploitation requires the ability to trigger BPF programs and audit events, which may be restricted by existing access controls. The absence of known exploits suggests limited immediate threat but underscores the need for timely patching to prevent potential denial-of-service attacks and maintain system reliability.

1. Apply the official Linux kernel patches that address CVE-2021-47128 as soon as they become available from trusted sources or Linux distribution vendors. This patch moves the SELinux lockdown check to the BPF program verification phase, resolving the OOM and deadlock issues. 2. Temporarily disable SELinux lockdown mode if feasible and if the risk of disabling lockdown is acceptable, to avoid triggering the buggy lockdown permission checks. 3. Limit the use of BPF tracing tools (bpftrace, BCC, perf, systemtap) to trusted administrators and restrict their execution to prevent unprivileged users from installing BPF programs. 4. Monitor audit logs and system metrics for signs of excessive memory usage or deadlocks related to audit subsystem or BPF tracing activities. 5. Implement strict SELinux policies that explicitly allow only authorized tracing tools to load BPF programs, minimizing the attack surface. 6. In environments where patching is delayed, consider disabling or restricting the audit subsystem's interaction with SELinux lockdown to reduce the risk of OOM or deadlock. 7. Regularly update Linux kernel and security modules to incorporate fixes and improvements related to lockdown and BPF subsystems. 8. Conduct thorough testing of BPF-based monitoring tools in controlled environments after patching to ensure compatibility and stability.