CVE-2021-47324

What it actually does

Use-after-free in the watchdog driver remove path: del_timer() returns without waiting for a pending timer handler (wdt_startup) to complete, allowing the handler to access module memory that has already been freed.

Why it matters to the business

Kernel memory corruption can cause system crashes, denial of service, or local privilege escalation on any Linux system that loads the affected watchdog module and later unloads it.

How an attack unfolds

An attacker with local access triggers repeated module load/unload operations (or device hot-unplug) while the watchdog timer is armed; the race between del_timer and the still-running handler dereferences freed objects, leading to arbitrary kernel read/write or crash.

How to fix it

Upgrade the Linux kernel to a version containing the fix that replaces del_timer with del_timer_sync in the watchdog remove path; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel source contains the del_timer_sync change in the watchdog remove function; verify no crash reports referencing the watchdog timer handler after module unload; re-test module load/unload cycles under load.

Typical attack path

1. Obtain local unprivileged access on a Linux host using the vulnerable watchdog driver
2. Load the watchdog module and arm the timer
3. Trigger module removal (rmmod or device removal) while the timer is pending
4. Race the del_timer call against the still-executing handler
5. Use the resulting use-after-free for memory corruption or information leak

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for use-after-free warnings, slab object reuse errors, or oops traces referencing wdt_startup or watchdog timer functions around module unload events; correlate with audit logs showing rmmod or modprobe activity.

What your security team should do

• Patch all Linux systems to a kernel containing the del_timer_sync fix as soon as possible
• Disable or blacklist unnecessary watchdog modules where feasible until patched
• Monitor for kernel oops/panic logs mentioning watchdog timer handlers