CVE-2021-46904

net: hso: fix null-ptr-deref during tty device unregistration

MEDIUM
5.5
CVSS Score
Published: February 25, 2024 at 02:03 PM UTC
Updated: June 17, 2026 at 04:15 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: net: hso: fix null-ptr-deref during tty device unregistration Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref. The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number. Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modify it to free up the minor number of the given hso_serial. Every obtain_minor() should have corresponding release_minor() call.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.27 ≤ v < 4.14.2322.6.27 ≤ v < 4.19.1872.6.27 ≤ v < 4.4.2682.6.27 ≤ v < 4.9.2682.6.27 ≤ v < 5.10.302.6.27 ≤ v < 5.11.142.6.27 ≤ v < 5.122.6.27 ≤ v < 5.4.1124.10.0 ≤ v < 4.14.2324.15.0 ≤ v < 4.19.1874.20.0 ≤ v < 5.4.1124.5.0 ≤ v < 4.9.2685.11.0 ≤ v < 5.11.145.5.0 ≤ v < 5.10.302.6.2772dc1c096c7051a48ab1dbb12f71976656b55eb5
Vendor states this is fixed in 145c89c441d27696961752bf51b323f347601bee (fixed)
Vendor states this is fixed in 388d05f70f1ee0cac4a2068fd295072f1a44152a (fixed)
Vendor states this is fixed in 4a2933c88399c0ebc738db39bbce3ae89786d723 (fixed)
Vendor states this is fixed in 8a12f8836145ffe37e9c8733dce18c22fb668b66 (fixed)
Vendor states this is fixed in 92028d7a31e55d53e41cff679156b9432cffcb36 (fixed)
Vendor states this is fixed in a462067d7c8e6953a733bf5ade8db947b1bb5449 (fixed)
Vendor states this is fixed in caf5ac93b3b5d5fac032fc11fbea680e115421b4 (fixed)
Vendor states this is fixed in dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac (fixed)
Vendor states this is fixed in 2.6.27 (unaffected)
Vendor states this is fixed in 4.14.232 (unaffected)
Vendor states this is fixed in 4.19.187 (unaffected)
Vendor states this is fixed in 4.4.268 (unaffected)
Vendor states this is fixed in 4.9.268 (unaffected)
Vendor states this is fixed in 5.10.30 (unaffected)
Vendor states this is fixed in 5.11.14 (unaffected)
Vendor states this is fixed in 5.12 (unaffected)
Vendor states this is fixed in 5.4.112 (unaffected)

References (8)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601bee
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152a
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card