CVE-2021-47603

What it actually does

A blocked kauditd_thread() due to a stopped audit daemon allows the audit queue to grow unbounded because certain events bypass queue limits to avoid deadlock, potentially causing kernel panic or system unresponsiveness.

Why it matters to the business

Under heavy auditing workloads, an attacker with root access can cause prolonged slowdowns or crashes during system operation or shutdown, increasing operational risk on Linux systems that rely on audit logging.

How an attack unfolds

An attacker with root privileges sends SIGSTOP to the audit daemon, then triggers high volumes of auditable events such as syscalls; the kernel thread blocks on the socket send, the queue grows without bound, and the system eventually panics or becomes unresponsive.

How to fix it

Update the Linux kernel to the fixed commit a351e9b9fc24e982ec2f0e76379a49826036da12 or later release containing the reduced socket timeout and improved kauditd_send_queue() handling.

How to confirm the fix worked

Verify the running kernel contains commit a351e9b9fc24e982ec2f0e76379a49826036da12, test audit daemon stop scenarios under load to confirm queue draining continues without panic, and review kernel audit subsystem source for the HZ/10 timeout.

Typical attack path

1. Obtain root privileges on the target Linux system
2. Stop the audit daemon process
3. Generate sustained high-volume audit events
4. Trigger kernel thread blocking and unbounded queue growth
5. Cause system slowdown, deadlock, or panic

How to detect it

Review kernel logs for audit queue growth messages, kauditd thread blocking indicators, or unexpected system panics during high audit load; correlate with audit daemon process stop events.

What your security team should do

• Apply the kernel patch containing commit a351e9b9fc24e982ec2f0e76379a49826036da12 to all affected systems
• Monitor systems with heavy audit configurations for queue backlog warnings
• Ensure audit daemon is running and restart it promptly if it stops unexpectedly