CVE-2021-47403

What it actually does

A reference to the carrier module is acquired on every device open but released only once on final tty struct drop, causing unbalanced module reference counts that can prevent proper module unloading or lead to use-after-free conditions.

Why it matters to the business

Systems may experience kernel instability, crashes, or resource leaks when using affected serial drivers, potentially disrupting operations on embedded or industrial Linux systems.

How an attack unfolds

An attacker with local access opens the affected tty device multiple times to increment module references without corresponding decrements, potentially forcing module unload while references remain, leading to memory corruption or denial of service.

How to fix it

Update the Linux kernel to a version containing the fix for the module reference handling in the ipoctal driver.

How to confirm the fix worked

Verify kernel source or running version includes the commit fixing the reference leak in ipoctal.c, and test device open/close sequences for balanced module references.

Typical attack path

1. Gain local user access on affected Linux system
2. Interact with ipoctal tty devices to trigger repeated opens
3. Trigger module unload attempts to exploit leaked references
4. Cause kernel panic or memory corruption

How to detect it

Examine kernel logs for module reference count warnings or oops during tty device usage and module unload attempts.

What your security team should do

• Apply kernel updates containing the referenced fix
• Audit usage of ipack/ipoctal devices in the environment
• Monitor for kernel oops related to module unloading