CVE-2021-47086

What it actually does

The phonet/pep ioctl handler implicitly assumes a bound Phonet socket and proceeds to send an enablement request using an invalid source object when the socket is unbound; subsequent socket operations can then trigger a kernel BUG due to an inconsistent connected-but-unbound state.

Why it matters to the business

Unpatched kernels may experience unexpected crashes or denial-of-service conditions during use of the Phonet protocol, increasing operational risk for systems that rely on it; low exploitability and absence from known campaigns reduce immediate urgency.

How an attack unfolds

An attacker with the ability to create and manipulate Phonet sockets invokes the pipe-enable ioctl on an unbound socket, causing the kernel to transmit an invalid source identifier and later encounter an inconsistent socket state that can be leveraged for denial-of-service or, in specialized Android kernel contexts, further exploitation attempts.

How to fix it

Apply the upstream kernel commit that adds an explicit check refusing to enable an unbound pipe; update to a kernel version containing the fix for the phonet/pep subsystem.

How to confirm the fix worked

Confirm the presence of the refusal check in the phonet/pep ioctl handler source; attempt the previously problematic ioctl on an unbound socket and verify it now returns an error instead of proceeding.

Typical attack path

1. Create a Phonet socket without binding it to a valid local object
2. Issue the pipe-enable ioctl on the unbound socket
3. Trigger subsequent socket operations that expose the inconsistent state
4. Observe or exploit the resulting BUG or invalid request behavior

How to detect it

Review kernel logs for BUG messages referencing phonet or pep sockets and audit source code or runtime behavior for missing bind checks before pipe-enable ioctls.

What your security team should do

• Inventory Linux systems using the Phonet protocol and schedule kernel updates
• Monitor EPSS and KEV status for any change in exploit maturity
• Apply defense-in-depth network controls around Phonet usage where feasible