CVE-2021-46959
published 2024-02-29CVE-2021-46959: In the Linux kernel, the following vulnerability has been resolved: spi: Fix use-after-free with devm_spi_alloc_* We can't rely on the contents of the devres…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
15.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
spi: Fix use-after-free with devm_spi_alloc_*
We can't rely on the contents of the devres list during
spi_unregister_controller(), as the list is already torn down at the
time we perform devres_find() for devm_spi_release_controller. This
causes devices registered with devm_spi_alloc_{master,slave}() to be
mistakenly identified as legacy, non-devm managed devices and have their
reference counters decremented below 0.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174
[] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98)
[] (kobject_put) from [] (put_device+0x20/0x24)
r4:b6700140
[] (put_device) from [] (devm_spi_release_controller+0x3c/0x40)
[] (devm_spi_release_controller) from [] (release_nodes+0x84/0xc4)
r5:b6700180 r4:b6700100
[] (release_nodes) from [] (devres_release_all+0x5c/0x60)
r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10
[] (devres_release_all) from [] (__device_release_driver+0x144/0x1ec)
r5:b117ad94 r4:b163dc10
[] (__device_release_driver) from [] (device_driver_detach+0x84/0xa0)
r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10
[] (device_driver_detach) from [] (unbind_store+0xe4/0xf8)
Instead, determine the devm allocation state as a flag on the
controller which is guaranteed to be stable during cleanup.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.38-1 (bookworm) | linux 5.10.38-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 0870525cf94bc27907e94ce99afb6d7239ffd2f5 < 8bf96425c90f5c1dcf3b7b9df568019a1d4b8a0e | 8bf96425c90f5c1dcf3b7b9df568019a1d4b8a0e |
| linux | linux | >= 234b432c7b6184b2d6c5ba2c55f0dd5023c0edf0 < 28a5529068c51cdf0295ab1e11a99a3a909a03e4 | 28a5529068c51cdf0295ab1e11a99a3a909a03e4 |
| linux | linux | >= 3e04a4976addbedcad326f47b0dd4efc570a1fac < 001c8e83646ad3b847b18f6ac55a54367d917d74 | 001c8e83646ad3b847b18f6ac55a54367d917d74 |
| linux | linux | >= 4.14.212 < 4.14.233 | 4.14.233 |
| linux | linux | >= 4.19.163 < 4.19.191 | 4.19.191 |
| linux | linux | >= 4.4.248 < 4.4.271 | 4.4.271 |
| linux | linux | >= 4.9.248 < 4.9.271 | 4.9.271 |
| linux | linux | >= 5.4.80 < 5.4.119 | 5.4.119 |
| linux | linux | >= 5.9.11 < 5.10 | 5.10 |
| linux | linux | >= 5e844cc37a5cbaa460e68f9a989d321d63088a89 < c7fabe372a9031acd00498bc718ce27c253abfd1 | c7fabe372a9031acd00498bc718ce27c253abfd1 |
| linux | linux | >= 5e844cc37a5cbaa460e68f9a989d321d63088a89 < cee78aa24578edac8cf00513dca618c0acc17cd7 | cee78aa24578edac8cf00513dca618c0acc17cd7 |
| linux | linux | >= 5e844cc37a5cbaa460e68f9a989d321d63088a89 < 8735248ebb918d25427965f0db07939ed0473ec6 | 8735248ebb918d25427965f0db07939ed0473ec6 |
| linux | linux | >= 5e844cc37a5cbaa460e68f9a989d321d63088a89 < 794aaf01444d4e765e2b067cba01cc69c1c68ed9 | 794aaf01444d4e765e2b067cba01cc69c1c68ed9 |
| linux | linux | >= 8c45a1c6c951bbe7f95db78fcab46f7337364468 < 8e029707f50a82c53172359c686b2536ab54e58c | 8e029707f50a82c53172359c686b2536ab54e58c |
| linux | linux | >= a4add022c1552b0d51a0b89a4781919d6ebac4f9 < 62bb2c7f2411a0045c24831f11ecacfc35610815 | 62bb2c7f2411a0045c24831f11ecacfc35610815 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 4.4.0-268.302 | 4.4.0-268.302 |
| linux | linux_kernel | >= 4.14.212 < 4.14.233 | 4.14.233 |
| linux | linux_kernel | >= 4.19.163 < 4.19.191 | 4.19.191 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2025-05-13·CVSS 7.8
CVE-2024-56650 [HIGH] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Hardware crypto device drivers;
- GPU drivers;
- IIO subsystem;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- SPI subsystem;
- USB Gadget drivers;
- Ceph distributed
Ubuntu
Linux kernel (FIPS) vulnerabilities
vendor_ubuntu·2025-05-12·CVSS 7.8
CVE-2024-56650 [HIGH] Linux kernel (FIPS) vulnerabilities
Title: Linux kernel (FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Hardware crypto device drivers;
- GPU drivers;
- IIO subsystem;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- SPI subsystem;
- USB Gadget drivers;
- Ceph distributed file
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-05-12·CVSS 7.8
CVE-2024-56650 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Hardware crypto device drivers;
- GPU drivers;
- IIO subsystem;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- SPI subsystem;
- USB Gadget drivers;
- Ceph distributed file system;
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2025-05-12·CVSS 7.8
CVE-2023-52741 [HIGH] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Hardware crypto device drivers;
- GPU drivers;
- IIO subsystem;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- SPI subsystem;
- USB Gadget drivers;
- Ceph distributed file s
Red Hat
kernel: spi: Fix use-after-free with devm_spi_alloc_*
vendor_redhat·2024-02-29·CVSS 7.8
CVE-2021-46959 [HIGH] CWE-416 kernel: spi: Fix use-after-free with devm_spi_alloc_*
kernel: spi: Fix use-after-free with devm_spi_alloc_*
In the Linux kernel, the following vulnerability has been resolved:
spi: Fix use-after-free with devm_spi_alloc_*
We can't rely on the contents of the devres list during
spi_unregister_controller(), as the list is already torn down at the
time we perform devres_find() for devm_spi_release_controller. This
causes devices registered with devm_spi_alloc_{master,slave}() to be
mistakenly identified as legacy, non-devm managed devices and have their
reference counters decremented below 0.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174
[] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98)
[] (kobject_put) from [] (put_device+0x20/0x24)
r4:b6700140
[] (put_device) fr
Debian
CVE-2021-46959: linux - In the Linux kernel, the following vulnerability has been resolved: spi: Fix us...
vendor_debian·2021·CVSS 7.8
CVE-2021-46959 [HIGH] CVE-2021-46959: linux - In the Linux kernel, the following vulnerability has been resolved: spi: Fix us...
In the Linux kernel, the following vulnerability has been resolved: spi: Fix use-after-free with devm_spi_alloc_* We can't rely on the contents of the devres list during spi_unregister_controller(), as the list is already torn down at the time we perform devres_find() for devm_spi_release_controller. This causes devices registered with devm_spi_alloc_{master,slave}() to be mistakenly identified as legacy, non-devm managed devices and have their reference counters decremented below 0. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174 [] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98) [] (kobject_put) from [] (put_device+0x20/0x24) r4:b6700140 [] (put_device) from [] (devm_spi_release_controller+0x3c/0x40) [] (devm_
OSV
linux-lts-xenial vulnerabilities
osv·2025-05-13·CVSS 7.8
CVE-2022-23041 [HIGH] linux-lts-xenial vulnerabilities
linux-lts-xenial vulnerabilities
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Hardware crypto device drivers;
- GPU drivers;
- IIO subsystem;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- SPI subsystem;
- USB Gadget drivers;
- Ceph distributed file system;
- File systems infrastructure;
- JFS file system;
- Network file sys
OSV
linux-fips vulnerabilities
osv·2025-05-12·CVSS 7.8
CVE-2022-23041 [HIGH] linux-fips vulnerabilities
linux-fips vulnerabilities
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Hardware crypto device drivers;
- GPU drivers;
- IIO subsystem;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- SPI subsystem;
- USB Gadget drivers;
- Ceph distributed file system;
- File systems infrastructure;
- JFS file system;
- Network file system (N
OSV
linux-aws vulnerabilities
osv·2025-05-12·CVSS 7.8
CVE-2022-23041 [HIGH] linux-aws vulnerabilities
linux-aws vulnerabilities
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Hardware crypto device drivers;
- GPU drivers;
- IIO subsystem;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- SPI subsystem;
- USB Gadget drivers;
- Ceph distributed file system;
- File systems infrastructure;
- JFS file system;
- Network file system (NF
OSV
linux, linux-aws, linux-kvm vulnerabilities
osv·2025-05-12·CVSS 7.8
CVE-2022-23041 [HIGH] linux, linux-aws, linux-kvm vulnerabilities
linux, linux-aws, linux-kvm vulnerabilities
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Hardware crypto device drivers;
- GPU drivers;
- IIO subsystem;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- SPI subsystem;
- USB Gadget drivers;
- Ceph distributed file system;
- File systems infrastructure;
- JFS file system;
- Netwo
GHSA
GHSA-p64f-v3w3-f3gw: In the Linux kernel, the following vulnerability has been resolved:
spi: Fix use-after-free with devm_spi_alloc_*
We can't rely on the contents of t
ghsa_unreviewed·2024-03-01
CVE-2021-46959 [HIGH] CWE-416 GHSA-p64f-v3w3-f3gw: In the Linux kernel, the following vulnerability has been resolved:
spi: Fix use-after-free with devm_spi_alloc_*
We can't rely on the contents of t
In the Linux kernel, the following vulnerability has been resolved:
spi: Fix use-after-free with devm_spi_alloc_*
We can't rely on the contents of the devres list during
spi_unregister_controller(), as the list is already torn down at the
time we perform devres_find() for devm_spi_release_controller. This
causes devices registered with devm_spi_alloc_{master,slave}() to be
mistakenly identified as legacy, non-devm managed devices and have their
reference counters decremented below 0.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174
[] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98)
[] (kobject_put) from [] (put_device+0x20/0x24)
r4:b6700140
[] (put_device) from [] (devm_spi_release_controller+0x3c/0x40)
[] (de
OSV
CVE-2021-46959: In the Linux kernel, the following vulnerability has been resolved: spi: Fix use-after-free with devm_spi_alloc_* We can't rely on the contents of the
osv·2024-02-29·CVSS 7.8
CVE-2021-46959 [HIGH] CVE-2021-46959: In the Linux kernel, the following vulnerability has been resolved: spi: Fix use-after-free with devm_spi_alloc_* We can't rely on the contents of the
In the Linux kernel, the following vulnerability has been resolved: spi: Fix use-after-free with devm_spi_alloc_* We can't rely on the contents of the devres list during spi_unregister_controller(), as the list is already torn down at the time we perform devres_find() for devm_spi_release_controller. This causes devices registered with devm_spi_alloc_{master,slave}() to be mistakenly identified as legacy, non-devm managed devices and have their reference counters decremented below 0. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174 [] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98) [] (kobject_put) from [] (put_device+0x20/0x24) r4:b6700140 [] (put_device) from [] (devm_spi_release_controller+0x3c/0x40) [] (devm_
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/001c8e83646ad3b847b18f6ac55a54367d917d74https://git.kernel.org/stable/c/28a5529068c51cdf0295ab1e11a99a3a909a03e4https://git.kernel.org/stable/c/62bb2c7f2411a0045c24831f11ecacfc35610815https://git.kernel.org/stable/c/794aaf01444d4e765e2b067cba01cc69c1c68ed9https://git.kernel.org/stable/c/8735248ebb918d25427965f0db07939ed0473ec6https://git.kernel.org/stable/c/8bf96425c90f5c1dcf3b7b9df568019a1d4b8a0ehttps://git.kernel.org/stable/c/8e029707f50a82c53172359c686b2536ab54e58chttps://git.kernel.org/stable/c/c7fabe372a9031acd00498bc718ce27c253abfd1https://git.kernel.org/stable/c/cee78aa24578edac8cf00513dca618c0acc17cd7https://git.kernel.org/stable/c/001c8e83646ad3b847b18f6ac55a54367d917d74https://git.kernel.org/stable/c/28a5529068c51cdf0295ab1e11a99a3a909a03e4https://git.kernel.org/stable/c/62bb2c7f2411a0045c24831f11ecacfc35610815https://git.kernel.org/stable/c/794aaf01444d4e765e2b067cba01cc69c1c68ed9https://git.kernel.org/stable/c/8735248ebb918d25427965f0db07939ed0473ec6https://git.kernel.org/stable/c/8bf96425c90f5c1dcf3b7b9df568019a1d4b8a0ehttps://git.kernel.org/stable/c/8e029707f50a82c53172359c686b2536ab54e58chttps://git.kernel.org/stable/c/c7fabe372a9031acd00498bc718ce27c253abfd1https://git.kernel.org/stable/c/cee78aa24578edac8cf00513dca618c0acc17cd7
2024-02-29
Published