An issue was discovered in the linux kernel's tty subsystem handling during shutdown. The flaw was possible to take a reference to the ldisc during shutdown phase.

This race occurs on hangup of tty. It races and hangs on ldsemdownwrite on a semaphore that is being aquired by a new reader(CPU 1). The new reader/writer is sleeping in ldsemdownread() and the hangup is sleeping in ldsemdownwrite().

Resources:

Fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cf872776fc84128bb779ce2b83a37c884c3203ae CVE request: http://seclists.org/oss-sec/2015/q2/545