PT-2024-11082 · Linux · Linux Kernel

Bjorn Andersson · Published 2021-04-21 · Updated 2024-08-01 · CVE-2021-46973

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A potential use after free issue in the MHI send functionality of the Linux kernel has been resolved. The MHI ul callback may be invoked immediately after the skb is queued for transmission, leading to the callback decrementing the refcount of the associated sk and freeing the skb. To avoid this issue, the dereference of skb and the increment of the sk refcount must happen before the skb is queued.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-02847

CVE-2021-46973

Affected Products

Linux Kernel

References · 22

• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46973 · Vendor Advisory
• https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0 · Patch
• https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-46973 · Security Note
• https://bdu.fstec.ru/vul/2025-02847 · Security Note
• https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a · Patch
• https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80 · Patch
• https://ubuntu.com/security/CVE-2021-46973 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-46973 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46973 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-46973 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46973 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.19 · Note
• https://access.redhat.com/security/cve/CVE-2021-46973 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46973 · Note