CVE-2021-47374

What it actually does

An error message in the DMA debug subsystem can be triggered millions of times per second by certain drivers, flooding the printk buffer and consuming 100% CPU without rate limiting.

Why it matters to the business

Affected systems may suffer severe performance degradation or complete unresponsiveness under normal driver operation, with urgency increased by widespread Linux kernel usage across servers and devices.

How an attack unfolds

A driver or process repeatedly hits a DMA API error condition, causing the kernel to spam error messages at extreme rates and exhausting CPU resources; no named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade the Linux kernel to a version containing the fix or apply the equivalent change using err_printk; for thorsten/phpmyfaq (GIT) update to commit abf52487422ce47195c8a80bd904a7af39f60297.

How to confirm the fix worked

Confirm err_printk is used in dma-debug paths, reproduce the error condition under load, and verify that message volume remains bounded rather than reaching millions per second.

Typical attack path

1. Trigger repeated DMA API errors via affected driver operations
2. Cause uncontrolled printk calls without rate limiting
3. Observe system-wide CPU saturation and logging buffer overflow

How to detect it

Inspect kernel logs for repeated DMA debug error messages, monitor CPU usage spikes correlated with printk activity, and review system performance during driver error conditions.

What your security team should do

• Prioritize kernel upgrades on all affected systems due to 882 days since publication
• Audit DMA-using drivers for conditions that trigger the error path
• Enable kernel logging rate limiting as a temporary control
• Monitor EPSS trend for any future increase in exploit likelihood