CVE-2021-47391 is a use-after-free vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) connection manager (cma) subsystem. The flaw arises from improper handling of address resolution requests in the RDMA connection manager finite state machine (FSM). Specifically, the vulnerability occurs because the function rdma_resolve_ip() can be called twice on the same id_priv structure without properly canceling the previous request. This leads to two requests being queued simultaneously in the req_list for the same handle. The rdma_addr_cancel() function, which is responsible for canceling outstanding requests, only cancels the first request on the list, leaving the second request active. When the id_priv structure is freed during rdma_destroy_id(), the second request still references this freed memory. Subsequent processing of this second request results in a use-after-free condition, which can cause kernel crashes or potentially allow an attacker to execute arbitrary code in kernel space. The root cause is a violation of the invariant that only one address resolution request should be active per id_priv at any time. The fix involves tracking whether rdma_resolve_ip() has been called and ensuring that any existing request is canceled before issuing a new one, preventing multiple concurrent requests and eliminating the use-after-free scenario. This vulnerability affects Linux kernel versions containing the specified commit e51060f08a61965c4dd91516d82fe90617152590 and likely other versions with similar RDMA CMA implementations. No known exploits are reported in the wild as of the publication date.

For European organizations, this vulnerability poses a significant risk primarily to systems that utilize RDMA technology, which is common in high-performance computing, data centers, and enterprise storage networks. Exploitation could lead to kernel crashes (denial of service) or potentially privilege escalation if an attacker can trigger the use-after-free condition to execute arbitrary code in kernel space. This could compromise the confidentiality, integrity, and availability of critical systems. Given that Linux is widely used across European industries, including finance, telecommunications, research institutions, and government infrastructure, the impact could be broad if vulnerable kernels are deployed in environments where RDMA is enabled. The vulnerability is particularly concerning in environments where RDMA is used for low-latency, high-throughput networking, such as in HPC clusters or cloud providers offering RDMA-enabled services. Disruption or compromise of these systems could affect data processing, storage integrity, and service availability, with cascading effects on business operations and critical infrastructure.

European organizations should take the following specific actions: 1) Identify all Linux systems running kernels with RDMA CMA support and verify if they include the vulnerable commit or similar code paths. 2) Apply the official Linux kernel patches that address CVE-2021-47391 as soon as they become available from trusted sources or Linux distributions. 3) If immediate patching is not possible, consider disabling RDMA functionality temporarily on affected systems to mitigate risk, especially on systems exposed to untrusted users or networks. 4) Implement strict access controls and monitoring on systems using RDMA to detect anomalous behavior that could indicate exploitation attempts. 5) Conduct thorough testing of patched kernels in staging environments to ensure stability and compatibility with existing RDMA workloads before deployment. 6) Maintain up-to-date inventory and configuration management to track RDMA usage and kernel versions across the enterprise. 7) Engage with Linux distribution vendors and security advisories to receive timely updates and guidance. 8) Educate system administrators and security teams about the specific nature of this vulnerability to improve detection and response capabilities.