CVE-2021-47546 is a vulnerability in the Linux kernel's IPv6 networking stack that causes a memory leak in the fib6_rule_suppress function. This issue arises when IPv6 nftables firewall rules include a 'fib' rule combined with a suppress_prefix rule in the IPv6 routing rules, a configuration used by tools such as wg-quick. Specifically, the kernel leaks memory in the ip6_dst_cache slab cache for every incoming IPv6 packet under these conditions. The root cause is a logic error introduced by a commit (ca7a03c41753) that incorrectly handles reference counting due to the use of generic flags (FIB_LOOKUP_NOREF) instead of protocol-specific flags (RT6_LOOKUP_F_DST_NOREF) when suppressing fib6 rules. This results in the reference count not being decremented properly, causing a persistent memory leak. The vulnerability can be reproduced by creating specific nftables rules and IPv6 routing rules that trigger the leak, which can be observed via slabtop monitoring. The patch fixes the issue by exposing protocol-specific flags to the suppress function and correctly checking RT6_LOOKUP_F_DST_NOREF when decreasing the reference count. This vulnerability affects Linux kernel versions containing the specified commits and is relevant to systems using IPv6 with nftables and suppress_prefix routing rules. No known exploits are reported in the wild as of the publication date.

For European organizations, this vulnerability can lead to gradual memory exhaustion on Linux systems heavily processing IPv6 traffic with the affected nftables and routing configurations. This could degrade system performance, cause denial of service due to resource depletion, or trigger kernel instability and crashes. Organizations relying on IPv6 networking, particularly those using VPN solutions like WireGuard (wg-quick) or custom nftables firewall rules incorporating fib and suppress_prefix rules, are at risk. The impact is more pronounced in high-throughput environments such as ISPs, cloud providers, data centers, and enterprises with IPv6-enabled infrastructure. Memory leaks in kernel space are critical as they can lead to unpredictable system behavior and require reboots to recover, affecting availability and operational continuity. While this vulnerability does not directly expose confidentiality or integrity risks, the resulting denial of service can disrupt critical services and business operations.

1. Update the Linux kernel to a version that includes the patch fixing CVE-2021-47546. Monitor official Linux kernel releases and distributions for security updates addressing this issue. 2. Review and audit IPv6 nftables firewall rules and routing configurations to identify the use of fib rules combined with suppress_prefix rules. Temporarily disable or modify these rules if feasible to mitigate memory leak risk until patched. 3. Monitor system memory usage, especially the ip6_dst_cache slab cache, using tools like slabtop or other kernel memory monitoring utilities to detect abnormal growth indicative of the leak. 4. For environments using wg-quick or similar tools, verify the versions and configurations to avoid triggering the vulnerability. 5. Implement proactive system resource monitoring and alerting to detect early signs of memory exhaustion. 6. Consider deploying kernel live patching solutions if available to apply fixes without downtime. 7. Engage with Linux distribution security advisories and apply vendor-specific patches promptly. 8. Document and test firewall and routing rule changes in staging environments before production deployment to prevent inadvertent exposure to this vulnerability.