PT-2021-8071 · Linux+2 · Linux Kernel+2

Seongjae Park · Published 2021-12-31 · Updated 2026-03-14 · CVE-2021-46937

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the DAMON debugfs interface in the Linux kernel, which increases the reference counts of struct pids for targets from the 'target ids' file write callback (dbgfs target ids write()), but decreases the counts only in DAMON monitoring termination callback (dbgfs before terminate()). When the 'target ids' file is repeatedly written without DAMON monitoring start/termination, the reference count is not decreased, and therefore, memory for the struct pid cannot be freed. This can lead to a memory leak. The vulnerability may allow an attacker to disclose protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2024-06286

CVE-2021-46937

Affected Products

Debian

Linux Kernel

Red Os

References · 19

• https://cve.org/CVERecord?id=CVE-2021-46937 · Security Note
• https://ubuntu.com/security/CVE-2021-46937 · Vendor Advisory
• https://git.kernel.org/stable/c/ffe4a1ba1a82c416a6b3a09d46594f6a885ae141 · Patch
• https://bdu.fstec.ru/vul/2024-06286 · Security Note
• https://git.kernel.org/stable/c/ebb3f994dd92f8fb4d70c7541091216c1e10cb71 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46937 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46937 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-46937 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2021-46937 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46937 · Security Note
• https://lore.kernel.org/linux-cve-announce/2024022751-CVE-2021-46937-3ae8@gregkh/T/#u · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.13 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46937 · Note
• https://git.kernel.org/linus/ebb3f994dd92f8fb4d70c7541091216c1e10cb71 · Note