CVE-2021-47603 is a vulnerability identified in the Linux kernel's audit subsystem, specifically related to the handling of the audit queue by the kernel audit daemon thread (kauditd_thread). The audit subsystem is responsible for recording system events for security and compliance purposes. The vulnerability arises when the userspace audit daemon is stopped or becomes unresponsive, causing the kernel thread to block while attempting to send audit records. This blocking can lead to an unbounded growth of the audit queue because certain audit record generating events are exempt from queue limits to avoid deadlocks. Without proper handling, this situation could cause the system to enter a deadlock state or kernel panic under heavy audit pressure, such as when auditing every system call. The patch addressing this vulnerability reduces the socket sending timeout from MAX_SCHEDULE_TIMEOUT (effectively indefinite) to HZ/10 (a fraction of a second) and improves queue management to allow the kauditd_thread to continue processing audit records even if the audit daemon is stopped. This prevents the audit queue from growing indefinitely and avoids system deadlock or kernel panic, albeit at the cost of slower system shutdown under extreme audit load. Exploitation requires root privileges to stop the audit daemon (e.g., sending SIGSTOP), limiting the attack vector to privileged users. The fix is implemented in Linux kernel versions after the affected commits, ensuring more robust audit queue handling and system stability during audit daemon failures or stoppages.

For European organizations relying on Linux systems, especially those with stringent auditing and compliance requirements (e.g., financial institutions, healthcare providers, government agencies), this vulnerability could lead to system instability or denial of service under specific conditions where the audit daemon is stopped or unresponsive. Although exploitation requires root access, an attacker or misconfigured system could cause audit daemon stoppage, leading to potential deadlocks or kernel panics that disrupt critical services. This could impact availability of key infrastructure, delay shutdowns, or cause unexpected system behavior during high audit loads. Organizations with high audit verbosity (e.g., auditing every syscall) are particularly at risk. The vulnerability does not directly expose confidentiality or integrity risks but poses a significant availability risk, which can indirectly affect operational continuity and compliance reporting accuracy.

European organizations should ensure that their Linux systems are updated to kernel versions that include the patch for CVE-2021-47603. Specifically, they should track kernel updates from their Linux distribution vendors and apply security patches promptly. Additionally, organizations should monitor the audit daemon's health and configure alerting to detect if the audit daemon stops or becomes unresponsive. Implementing automated recovery or restart mechanisms for the audit daemon can prevent prolonged stoppages. Limiting root access and enforcing strict privilege management reduces the risk of malicious or accidental stopping of the audit daemon. For systems with extremely high audit loads, consider tuning audit policies to balance audit coverage with system performance and stability. Finally, testing shutdown procedures under audit pressure can help identify potential issues before production deployment.