CVE-2021-46905
net: hso: fix NULL-deref on disconnect regression
Reported by linux · Published February 25, 2024
In the Linux kernel, the following vulnerability has been resolved: net: hso: fix NULL-deref on disconnect regression Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration") fixed the racy minor allocation reported by syzbot, but introduced an unconditional NULL-pointer dereference on every disconnect instead. Specifically, the serial device table must no longer be accessed after the minor has been released by hso_serial_tty_unregister().
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kernel-tools-devel | Amazon Linux | 4.14.232-176.381.amzn2 |
| kernel | Amazon Linux | 4.14.232-176.381.amzn2 |
| kernel-livepatch-4.14.232-176.381 | Amazon Linux | 1.0-0.amzn2 |
| kernel-headers | Amazon Linux | 4.14.232-176.381.amzn2 |
| kernel-tools | Amazon Linux | 4.14.232-176.381.amzn2 |
| linux_kernel | linux | 5.11.17, 5.10.33, 5.4.115, 4.19.189 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | a462067d7c8e6953a733bf5ade8db947b1bb5449, 145c89c441d27696961752bf51b323f347601bee, caf5ac93b3b5d5fac032fc11fbea680e115421b4 |
| Linux | Linux | 5.12, 0, 4.19.189 |
| amazon:2 | kernel-tools-devel | 0 |
| amazon:2 | kernel | 0 |
| amazon:2 | kernel-livepatch-4.14.232-176.381 | 0 |
| amazon:2 | kernel-headers | 0 |
| amazon:2 | kernel-tools | 0 |
| linux | linux_kernel | 4.19.187, 5.10.30, 5.11.14 |
| amazon:2 | python-perf | 0 |
| amazon:2 | perf | 0 |
| Linux | Linux | 5.13, *, 5.12 |
| amazon:2 | kernel-devel | 0 |
Timeline
- Feb 25, 2024 CVE Published
- Feb 26, 2024 EPSS Score (30 in total, the first dated here)
- Jun 2, 2026 Security Advisory (127 in total, the first dated here)
- Jul 13, 2026 Coalition ESS Score
- Aug 10, 2026 Distribution Patch (116 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-46905
vulnetix vdb fixes CVE-2021-46905Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-46905/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart