CVE-2021-47359

What it actually does

The flaw triggers a soft lockup in the CIFS client code path under concurrent filesystem stress, causing a CPU to remain stuck and the watchdog to report a hang that can render the system unresponsive.

Why it matters to the business

Systems performing heavy file operations over CIFS mounts can freeze without warning, interrupting workloads and requiring manual intervention or reboot to restore service.

How an attack unfolds

An attacker with the ability to mount a CIFS share and induce sustained filesystem stress (such as repeated open/read/write/delete cycles) can trigger the locking condition that leads to the CPU hang.

How to fix it

Apply the upstream kernel commit that resolves the soft lockup in the CIFS module; rebuild and deploy the updated kernel on all affected systems. Where immediate patching is not possible, limit CIFS mount usage or reduce concurrent filesystem stress on those mounts.

How to confirm the fix worked

Confirm the kernel version contains the fix by checking the CIFS source for the resolved locking logic; reproduce fsstress workloads on a test system and verify absence of the soft lockup watchdog message.

Typical attack path

1. Mount a CIFS share from an attacker-controlled or untrusted server
2. Execute a workload that generates high concurrent filesystem operations (fsstress-equivalent)
3. Sustain the load until the CIFS code path enters the locking state that starves the CPU
4. Observe or confirm the soft lockup watchdog message and resulting system unresponsiveness

How to detect it

Search kernel logs and dmesg output for repeated 'watchdog: BUG: soft lockup' messages that reference CPU stalls during CIFS activity; correlate with processes performing heavy file I/O over CIFS mounts.

• watchdog: BUG: soft lockup - CPU
• cifs: Fix soft lockup during fsstress

What your security team should do

• Prioritize kernel updates on all systems that mount CIFS shares
• Monitor kernel logs for 'watchdog: BUG: soft lockup' entries involving CIFS
• Restrict CIFS mounts to trusted servers until patches are deployed
• Test the fix in a staging environment using equivalent filesystem stress workloads before production rollout