Riskcovery

CVE-2021-47361

mcb: fix error handling in mcb_alloc_bus()

State
Published
Severity
Not scored
Published
May 21, 2024
Updated
May 11, 2026
Reserved
May 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

mcb: fix error handling in mcb_alloc_bus()

There are two bugs: 1) If ida_simple_get() fails then this code calls put_device(carrier) but we haven't yet called get_device(carrier) and probably that leads to a use after free. 2) After device_initialize() then we need to use put_device() to release the bus. This will free the internal resources tied to the device and call mcb_free_bus() which will free the rest.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 18d28819809909c3f24bb72183a901c5e332a63d to before 8a558261fa57a6deefb0925ab1829f698b194aeaAffected
  • 18d28819809909c3f24bb72183a901c5e332a63d to before 115b07d9f47e3996430b8f2007edd9768e1f807fAffected
  • 18d28819809909c3f24bb72183a901c5e332a63d to before 66f74ba9be9daf9c47fface6af3677f602774f6bAffected
  • 18d28819809909c3f24bb72183a901c5e332a63d to before 7751f609eadf36b1f53712bae430019c53a16eb0Affected
  • 18d28819809909c3f24bb72183a901c5e332a63d to before 91e4ad05bf18322b5921d1a6c9b603f6eb1694f0Affected
  • 18d28819809909c3f24bb72183a901c5e332a63d to before 9fc198f415dee070a1de957bb5bf5921d8df3499Affected
  • 18d28819809909c3f24bb72183a901c5e332a63d to before 25a1433216489de4abc889910f744e952cb6dbaeAffected
LinuxLinux
  • 4.7Affected
  • before 4.7Not affected
  • 4.9.285 through 4.9.*Not affected
  • 4.14.249 through 4.14.*Not affected
  • 4.19.209 through 4.19.*Not affected
  • 5.4.150 through 5.4.*Not affected
  • 5.10.70 through 5.10.*Not affected
  • 5.14.9 through 5.14.*Not affected
  • 5.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.