{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-46973","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-27T18:42:55.944Z","datePublished":"2024-02-27T18:47:07.880Z","dateUpdated":"2026-08-05T08:45:19.247Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:45:19.247Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: Avoid potential use after free in MHI send\n\nIt is possible that the MHI ul_callback will be invoked immediately\nfollowing the queueing of the skb for transmission, leading to the\ncallback decrementing the refcount of the associated sk and freeing the\nskb.\n\nAs such the dereference of skb and the increment of the sk refcount must\nhappen before the skb is queued, to avoid the skb to be used after free\nand potentially the sk to drop its last refcount.."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in qcom_mhi_qrtr_send, reached only when a local process sendmsg()s on an AF_QIPCRTR socket to a remote QRTR node backed by the MHI IPCR endpoint; it is not triggered by inbound network/modem frames alone.\nAC:L - An attacker fully controls the send side and can flood sends so the MHI UL completion tasklet runs on another CPU between mhi_queue_skb() and sock_hold(), making the race reliably hittable on SMP without conditions outside attacker influence.\nPR:L - qrtr_create() imposes no capability check, and ephemeral port bind/send requires only an unprivileged local account (CAP_NET_ADMIN is needed only for ports below the ephemeral range).\nUI:N - The attacker triggers the vulnerable send path with their own socket operations; no separate victim action is required.\nS:U - Impact is kernel memory corruption/privilege escalation within the same host kernel authority, with no VM/IOMMU/sandbox boundary crossed.\nC:H - The UAF lets the UL callback free the skb (and potentially the sk via an unbalanced sock_put) before sock_hold(skb->sk), enabling heap reuse and arbitrary read primitives per UAF guidance.\nI:H - The same skb/sk use-after-free is exploitable for heap spray and write/control-flow hijack primitives, so integrity impact is High.\nA:H - Dereferencing the freed skb or prematurely freeing the socket causes kernel oops/panic even without full exploitation, so availability impact is High."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/qrtr/mhi.c"],"versions":[{"version":"6e728f321393b1fce9e1c2c3e55f9f7c15991321","lessThan":"48ec949ac979b4b42d740f67b6177797af834f80","status":"affected","versionType":"git"},{"version":"6e728f321393b1fce9e1c2c3e55f9f7c15991321","lessThan":"ea474054c2cc6e1284604b21361f475c7cc8c0a0","status":"affected","versionType":"git"},{"version":"6e728f321393b1fce9e1c2c3e55f9f7c15991321","lessThan":"03c649dee8b1eb5600212a249542a70f47a5ab40","status":"affected","versionType":"git"},{"version":"6e728f321393b1fce9e1c2c3e55f9f7c15991321","lessThan":"47a017f33943278570c072bc71681809b2567b3a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/qrtr/mhi.c"],"versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","status":"unaffected","versionType":"semver"},{"version":"5.10.35","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.11.19","lessThanOrEqual":"5.11.*","status":"unaffected","versionType":"semver"},{"version":"5.12.2","lessThanOrEqual":"5.12.*","status":"unaffected","versionType":"semver"},{"version":"5.13","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.10.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.11.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.12.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.13"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80"},{"url":"https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0"},{"url":"https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40"},{"url":"https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a"}],"title":"net: qrtr: Avoid potential use after free in MHI send","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-416","lang":"en","description":"CWE-416 Use After Free"}]}],"affected":[{"vendor":"linux","product":"linux_kernel","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"6e728f321393","status":"affected","lessThan":"48ec949ac979","versionType":"git"},{"version":"6e728f321393","status":"affected","lessThan":"ea474054c2cc","versionType":"git"},{"version":"6e728f321393","status":"affected","lessThanOrEqual":"03c649dee8b1","versionType":"git"},{"version":"6e728f321393","status":"affected","lessThan":"47a017f33943","versionType":"git"},{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"custom"},{"version":"5.10.35","status":"unaffected","lessThanOrEqual":"5.11","versionType":"custom"},{"version":"5.11.19","status":"unaffected","lessThanOrEqual":"5.12","versionType":"custom"},{"version":"5.12.2","status":"unaffected","lessThanOrEqual":"5.13","versionType":"custom"},{"version":"5.13","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.4,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-02-28T18:49:05.463431Z","id":"CVE-2021-46973","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-07-25T15:54:16.377Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T05:17:42.894Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a","tags":["x_transferred"]}]}]}}