CVE-2021-46904

net: hso: fix null-ptr-deref during tty device unregistration

State
Published
Severity
Not scored
Published
Feb 25, 2024
Updated
May 11, 2026
Reserved
Feb 25, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: hso: fix null-ptr-deref during tty device unregistration

Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref.

The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number.

Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modify it to free up the minor number of the given hso_serial. Every obtain_minor() should have corresponding release_minor() call.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 72dc1c096c7051a48ab1dbb12f71976656b55eb5 to before a462067d7c8e6953a733bf5ade8db947b1bb5449Affected
  • 72dc1c096c7051a48ab1dbb12f71976656b55eb5 to before 145c89c441d27696961752bf51b323f347601beeAffected
  • 72dc1c096c7051a48ab1dbb12f71976656b55eb5 to before caf5ac93b3b5d5fac032fc11fbea680e115421b4Affected
  • 72dc1c096c7051a48ab1dbb12f71976656b55eb5 to before 92028d7a31e55d53e41cff679156b9432cffcb36Affected
  • 72dc1c096c7051a48ab1dbb12f71976656b55eb5 to before 4a2933c88399c0ebc738db39bbce3ae89786d723Affected
  • 72dc1c096c7051a48ab1dbb12f71976656b55eb5 to before dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72acAffected
  • 72dc1c096c7051a48ab1dbb12f71976656b55eb5 to before 388d05f70f1ee0cac4a2068fd295072f1a44152aAffected
  • 72dc1c096c7051a48ab1dbb12f71976656b55eb5 to before 8a12f8836145ffe37e9c8733dce18c22fb668b66Affected
LinuxLinux
  • 2.6.27Affected
  • before 2.6.27Not affected
  • 4.4.268 through 4.4.*Not affected
  • 4.9.268 through 4.9.*Not affected
  • 4.14.232 through 4.14.*Not affected
  • 4.19.187 through 4.19.*Not affected
  • 5.4.112 through 5.4.*Not affected
  • 5.10.30 through 5.10.*Not affected
  • 5.11.14 through 5.11.*Not affected
  • 5.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.