CVE-2021-46973

HighCVSS 7.8/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: Avoid potential use after free in MHI send

It is possible that the MHI ul_callback will be invoked immediately following the queueing of the skb for transmission, leading to the callback decrementing the refcount of the associated sk and freeing the skb.

As such the dereference of skb and the increment of the sk refcount must happen before the skb is queued, to avoid the skb to be used after free and potentially the sk to drop its last refcount..

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 6e728f321393b1fce9e1c2c3e55f9f7c15991321, < 48ec949ac979b4b42d740f67b6177797af834f80; >= 6e728f321393b1fce9e1c2c3e55f9f7c15991321, < ea474054c2cc6e1284604b21361f475c7cc8c0a0; >= 6e728f321393b1fce9e1c2c3e55f9f7c15991321, < 03c649dee8b1eb5600212a249542a70f47a5ab40; >= 6e728f321393b1fce9e1c2c3e55f9f7c15991321, < 47a017f33943278570c072bc71681809b2567b3a
LinuxLinux5.8
linuxlinux_kernel>= 6e728f321393, < 48ec949ac979; >= 6e728f321393, < ea474054c2cc; >= 6e728f321393, <= 03c649dee8b1; >= 6e728f321393, < 47a017f33943; 5.8

References

Timeline

Published
Feb 27, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-469745.5In the Linux kernel, the following vulnerability has been resolved: bpf: Fix masking negation logic upon negative dst register The negatioCVE-2021-469765.5In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix crash in auto_retire The retire logic uses the 2 lower bCVE-2021-469775.5In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Disable preemption when probing user return MSRs Disable preCVE-2021-469787.8In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always make an attempt to map eVMCS after migration When enCVE-2021-469795.5In the Linux kernel, the following vulnerability has been resolved: iio: core: fix ioctl handlers removal Currently ioctl handlers are remCVE-2021-469807.1In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4 coCVE-2021-469815.5In the Linux kernel, the following vulnerability has been resolved: nbd: Fix NULL pointer in flush_workqueue Open /dev/nbdX first, the conCVE-2021-469824.7In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix race condition of overwrite vs truncate pos_fsstreCVE-2021-469835.5In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: Fix NULL deref when SEND is completed with error When runnCVE-2021-469847.8In the Linux kernel, the following vulnerability has been resolved: kyber: fix out of bounds access when preempted __blk_mq_sched_bio_mergCVE-2021-469855.5In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: Fix a memory leak in an error handling path If 'acpi_devicCVE-2021-469865.5In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Free gadget structure only after freeing endpoints
CVE-2021-46973: High severity, CVSS 7.8 | Vulnix