PT-2024-11093 · Linux · Linux Kernel

Jack Pham · Published 2021-05-10 · Updated 2024-12-31 · CVE-2021-46986

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability has been resolved in the Linux kernel related to the usb: dwc3: gadget. The issue arises when the gadget structure is freed before freeing the endpoints, resulting in a dangling pointer situation. This occurs because the endpoints created in dwc3 gadget init endpoints() have their dep->endpoint.ep list members chained off the list head anchored at dwc->gadget->ep list. When dwc->gadget is freed, the first dwc3 ep in the list now has a dangling prev pointer and likewise for the next pointer of the dwc3 ep at the tail of the list. The dwc3 gadget free endpoints() that follows will result in a use-after-free when it calls list del(). This was caught by enabling KASAN and performing a driver unbind. The recent commit 568262bf5492 ("usb: dwc3: core: Add shutdown callback for dwc3") also exposes this as a panic during shutdown.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-06525

CVE-2021-46986

Affected Products

Linux Kernel

References · 23

• https://osv.dev/vulnerability/CVE-2021-46986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46986 · Security Note
• https://git.kernel.org/stable/c/1ea775021282d90e1d08d696b7ab54aa75d688e5 · Patch
• https://cve.org/CVERecord?id=CVE-2021-46986 · Security Note
• https://git.kernel.org/stable/c/bc0cdd72493236fb72b390ad38ce581e353c143c · Patch
• https://git.kernel.org/stable/c/b4b8e9601d7ee8806d2687f081a42485d27674a1 · Patch
• https://git.kernel.org/stable/c/bb9c74a5bd1462499fe5ccb1e3c5ac40dcfa9139 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46986 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-46986 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06525 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46986 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46986 · Vendor Advisory
• https://git.kernel.org/linus/bb9c74a5bd1462499fe5ccb1e3c5ac40dcfa9139 · Note
• https://lore.kernel.org/linux-cve-announce/2024022824-CVE-2021-46986-1d6e@gregkh · Note
• https://lore.kernel.org/linux-cve-announce/2024022824-CVE-2021-46986-1d6e@gregkh/T/#u · Note