CVE-2021-47185

What it actually does

Unbounded loop in flush_to_ldisc workqueue without need_resched or cond_resched checks allows continuous execution on non-preempt kernels, triggering watchdog softlockup when PTY data is written rapidly from another core.

Why it matters to the business

Systems can become unresponsive during high-volume terminal or serial operations, forcing reboots and interrupting services that rely on PTY or TTY handling.

How an attack unfolds

An attacker or test workload writes data continuously to a PTY master device while the kernel workqueue processes flush_to_ldisc on a separate CPU core; the absence of voluntary rescheduling keeps the work item running until the softlockup watchdog fires.

How to fix it

Update to a Linux kernel containing the fix for flush_to_ldisc that adds need_resched checks and cond_resched calls inside the processing loop.

How to confirm the fix worked

Confirm the kernel source contains the resched guards in flush_to_ldisc; run the pty04 LTP test case under load on non-preempt configurations and verify absence of softlockup warnings.

Typical attack path

1. Open or create a PTY pair
2. Write large volumes of data rapidly to the master side from one CPU
3. Trigger flush_to_ldisc on a different CPU via receive path
4. Sustain the write rate to prevent the workqueue from yielding
5. Observe softlockup panic or system stall

How to detect it

Inspect kernel logs for watchdog softlockup traces showing flush_to_ldisc and slip_unesc or tty_ldisc_receive_buf on the call stack; correlate with high PTY write activity.

• Workqueue: events_unbound flush_to_ldisc
• softlockup in flush_to_ldisc
• slip_unesc+0x80/0x214

What your security team should do

• Prioritize kernel updates on systems using PTY-heavy workloads such as containers, terminals, or serial consoles
• Monitor for softlockup messages in dmesg related to flush_to_ldisc
• Test updated kernels with LTP pty tests before broad deployment