CVE-2021-47654: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47654 affects the Linux kernel's landlock sample code, specifically involving a memory leak in the path_list allocation. The vulnerability was discovered and disclosed on February 26, 2025, when a Clang static analysis identified that memory allocated in the parse_path() function was never properly freed (NVD).

The vulnerability exists in the samples/landlock/sandboxer.c file where path_list is allocated in parse_path() but never freed, leading to a memory leak. The issue was identified at line 134 of sandboxer.c with the warning: 'Potential leak of memory pointed to by path_list' (Kernel Commit). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

The memory leak can lead to gradual system resource exhaustion, potentially affecting system availability over time. The vulnerability has been rated as having high impact on availability, though with no direct impact on confidentiality or integrity (Red Hat).

The vulnerability requires local access with low complexity to exploit. An attacker would need local user privileges to trigger the memory leak through the affected landlock sample code (Red Hat).

The vulnerability has been fixed by adding a free(path_list) call before the return statement in the affected code. The fix was implemented in commit 66b513b7c64a7290c1fbb88e657f7cece992e131 (Kernel Commit).