CVE-2021-47514: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47514 is a vulnerability in the Linux kernel's devlink subsystem, specifically in the devlink_nl_cmd_reload() function. The vulnerability was discovered in December 2021 and affects Linux kernel versions from 5.10 through 5.15.8, as well as 5.16 release candidates (rc1-rc4). The issue involves a network namespace reference count leak in the devlink reload command implementation (NVD).

The vulnerability stems from bugs in the devlink_nl_cmd_reload() function where certain error paths failed to release a reference count on a network namespace. This occurs due to improper scope management of get_net()/put_net() operations around the devlink_reload() call. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability results in a network namespace reference count leak, which could lead to resource exhaustion over time. This primarily affects system availability and resource management, though it does not directly impact system confidentiality or integrity (NVD).

The vulnerability requires local access and low privileges to exploit. The attack complexity is low, and no user interaction is required for exploitation. However, the impact is limited to availability through resource exhaustion (NVD).

The vulnerability has been fixed by reducing the scope of get_net()/put_net() section around the call to devlink_reload(). The fix was implemented through patches committed to the Linux kernel. The solution involves properly managing network namespace reference counting in the devlink reload command implementation (Kernel Patch).