In the Linux kernel, the following vulnerability has been resolved:

usb: mtu3: fix list_head check warning

This is caused by uninitialization of list_head.

BUG: KASAN: use-after-free in __list_del_entry_valid+0x34/0xe4

Call trace:
dump_backtrace+0x0/0x298
show_stack+0x24/0x34
dump_stack+0x130/0x1a8
print_address_description+0x88/0x56c
__kasan_report+0x1b8/0x2a0
kasan_report+0x14/0x20
__asan_load8+0x9c/0xa0
__list_del_entry_valid+0x34/0xe4
mtu3_req_complete+0x4c/0x300 [mtu3]
mtu3_gadget_stop+0x168/0x448 [mtu3]
usb_gadget_unregister_driver+0x204/0x3a0
unregister_gadget_item+0x44/0xa4

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
83374e035b6286731c5aa617844c7b724294c2a7 affected
< 585e2b244dda7ea733274e4b8fa27853d625d3bf
83374e035b6286731c5aa617844c7b724294c2a7 affected
< 3b6efe0b7ba03cc2acf0694b46d6ff33c5b4c295
83374e035b6286731c5aa617844c7b724294c2a7 affected
< 249ddfbe00570d6dc76208e88017937d4d374c79
83374e035b6286731c5aa617844c7b724294c2a7 affected
< 8c313e3bfd9adae8d5c4ba1cc696dcbc86fbf9bf
Linux Linux affected
Version Status Constraints
5.2 affected
—
0 unaffected
< 5.2
5.4.170 unaffected
≤ 5.4.*
5.10.90 unaffected
≤ 5.10.*
5.15.13 unaffected
≤ 5.15.*
5.16 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/249ddfbe00570d6dc76208e88017937d4d374c79 cve-icon cve-icon
https://git.kernel.org/stable/c/3b6efe0b7ba03cc2acf0694b46d6ff33c5b4c295 cve-icon cve-icon
https://git.kernel.org/stable/c/585e2b244dda7ea733274e4b8fa27853d625d3bf cve-icon cve-icon
https://git.kernel.org/stable/c/8c313e3bfd9adae8d5c4ba1cc696dcbc86fbf9bf cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024022749-CVE-2021-46930-99ca@gregkh/T/#u cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-46930 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-46930 cve-icon
History

Mon, 04 Nov 2024 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T07:00:33.638Z

Reserved: 2024-02-25T13:45:52.720Z

Link: CVE-2021-46930

cve-icon Vulnrichment

Updated: 2024-08-04T05:17:42.987Z

cve-icon NVD

Status : Modified

Published: 2024-02-27T10:15:07.637

Modified: 2024-11-21T06:34:57.520

Link: CVE-2021-46930

cve-icon Redhat

Severity : Low

Publid Date: 2024-02-27T00:00:00Z

Links: CVE-2021-46930 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses