CVE-2021-45095

What it actually does

A reference count leak in pep_sock_accept allows local processes to trigger repeated socket accept operations that fail to decrement the reference counter, resulting in kernel memory disclosure via the Phonet protocol stack.

Why it matters to the business

Local users on affected Linux systems can read kernel memory contents, increasing the risk of credential theft, privilege escalation, or exposure of sensitive system data across servers, embedded devices, and Android deployments.

How an attack unfolds

An attacker with local access crafts a sequence of Phonet PEP socket operations that repeatedly call pep_sock_accept without proper cleanup, leaking kernel pointers and memory contents that can be read back to map the kernel address space or locate other exploitable structures.

How to fix it

Upgrade the Linux kernel to a version containing commit bcd0f93353326954817a4f9fa55ec57fb38acbb0 or later; rebuild and reboot all affected systems. Where immediate patching is not possible, restrict unprivileged local access and disable the Phonet protocol if unused.

How to confirm the fix worked

Confirm the running kernel Git commit is at or beyond bcd0f93353326954817a4f9fa55ec57fb38acbb0 using uname -r combined with kernel build information; re-test socket accept paths in the Phonet stack with refcount tracing enabled to verify no further leaks occur.

Typical attack path

1. Obtain local user access on a vulnerable Linux kernel
2. Load or exercise the Phonet protocol by creating PEP sockets
3. Trigger repeated accept operations that leak reference counts
4. Read disclosed kernel memory to locate sensitive structures or bypass KASLR
5. Chain with additional kernel flaws for privilege escalation or data exfiltration

How to detect it

Review kernel audit logs and dmesg for unusual Phonet PEP socket activity; inspect process creation events around socket accept calls and correlate with any unexpected memory mapping or information disclosure attempts in system call traces.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-user Linux systems within the next maintenance window
• Inventory devices using the Phonet protocol and apply the fixed commit or distro backport
• Monitor EPSS trend and any new exploit publications given the modest but increasing score
• Harden local access controls and consider seccomp or LSM policies to limit socket protocol usage