CVE-2021-46969

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-46969", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-27T18:42:55.943Z", "datePublished": "2024-02-27T18:47:05.463Z", "dateUpdated": "2026-08-05T08:45:18.172Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:18.172Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: core: Fix invalid error returning in mhi_queue\n\nmhi_queue returns an error when the doorbell is not accessible in\nthe current state. This can happen when the device is in non M0\nstate, like M3, and needs to be waken-up prior ringing the DB. This\ncase is managed earlier by triggering an asynchronous M3 exit via\ncontroller resume/suspend callbacks, that in turn will cause M0\ntransition and DB update.\n\nSo, since it's not an error but just delaying of doorbell update, there\nis no reason to return an error.\n\nThis also fixes a use after free error for skb case, indeed a caller\nqueuing skb will try to free the skb if the queueing fails, but in\nthat case queueing has been done."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached by transmitting through local MHI client paths (mhi_net ndo_start_xmit or AF_QIPCRTR \u2192 qrtr_mhi xmit \u2192 mhi_queue_skb), which require local process access to a PCIe WWAN/MHI device interface rather than remote packet parsing.\nAC:L - With MHI PCI runtime autosuspend (2s), M3 is a normal idle state the attacker can wait for and then reliably trigger by sending traffic; no attacker-uncontrollable condition is required.\nPR:L - An unprivileged local user can open AF_QIPCRTR sockets (no capability required for ephemeral ports) or send packets via an already-up MHI WWAN netdev route; CAP_NET_ADMIN is not required for the vulnerable queue path itself.\nUI:N - Exploitation requires only attacker-initiated transmit while the modem is suspended; no separate victim user action is needed.\nS:U - Impact is confined to the host kernel's memory/process security authority (standard local privilege-escalation UAF), with no VM/IOMMU/sandbox boundary crossed.\nC:H - The skb remains referenced in the MHI transfer ring after the caller frees it, yielding a classic heap UAF that can be reclaimed/sprayed to obtain arbitrary kernel read primitives.\nI:H - The same skb UAF/double-free on completion (e.g. mhi_net_ul_callback / qrtr ul_callback consuming the freed skb) enables heap corruption and control-flow hijacking for arbitrary write/code execution.\nA:H - Use-after-free and double-free of the queued skb reliably cause kernel oops/panic when the deferred doorbell/completion path runs after M3 exit."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bus/mhi/core/main.c"], "versions": [{"version": "a8f75cb348fd52e7a5cf25991cdf9c89fb0cfd41", "lessThan": "a99b661c3187365f81026d89b1133a76cd2652b3", "status": "affected", "versionType": "git"}, {"version": "a8f75cb348fd52e7a5cf25991cdf9c89fb0cfd41", "lessThan": "0ecc1c70dcd32c0f081b173a1a5d89952686f271", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bus/mhi/core/main.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.3", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.12.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a99b661c3187365f81026d89b1133a76cd2652b3"}, {"url": "https://git.kernel.org/stable/c/0ecc1c70dcd32c0f081b173a1a5d89952686f271"}], "title": "bus: mhi: core: Fix invalid error returning in mhi_queue", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:42.873Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/a99b661c3187365f81026d89b1133a76cd2652b3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0ecc1c70dcd32c0f081b173a1a5d89952686f271", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46969", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:01:28.491057Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:45.299Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/a99b661c3187365f81026d89b1133a76cd2652b3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0ecc1c70dcd32c0f081b173a1a5d89952686f271", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:42.873Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46969", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:01:28.491057Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:18.501Z"}}], "cna": {"title": "bus: mhi: core: Fix invalid error returning in mhi_queue", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached by transmitting through local MHI client paths (mhi_net ndo_start_xmit or AF_QIPCRTR \u2192 qrtr_mhi xmit \u2192 mhi_queue_skb), which require local process access to a PCIe WWAN/MHI device interface rather than remote packet parsing.\nAC:L - With MHI PCI runtime autosuspend (2s), M3 is a normal idle state the attacker can wait for and then reliably trigger by sending traffic; no attacker-uncontrollable condition is required.\nPR:L - An unprivileged local user can open AF_QIPCRTR sockets (no capability required for ephemeral ports) or send packets via an already-up MHI WWAN netdev route; CAP_NET_ADMIN is not required for the vulnerable queue path itself.\nUI:N - Exploitation requires only attacker-initiated transmit while the modem is suspended; no separate victim user action is needed.\nS:U - Impact is confined to the host kernel's memory/process security authority (standard local privilege-escalation UAF), with no VM/IOMMU/sandbox boundary crossed.\nC:H - The skb remains referenced in the MHI transfer ring after the caller frees it, yielding a classic heap UAF that can be reclaimed/sprayed to obtain arbitrary kernel read primitives.\nI:H - The same skb UAF/double-free on completion (e.g. mhi_net_ul_callback / qrtr ul_callback consuming the freed skb) enables heap corruption and control-flow hijacking for arbitrary write/code execution.\nA:H - Use-after-free and double-free of the queued skb reliably cause kernel oops/panic when the deferred doorbell/completion path runs after M3 exit."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a8f75cb348fd52e7a5cf25991cdf9c89fb0cfd41", "lessThan": "a99b661c3187365f81026d89b1133a76cd2652b3", "versionType": "git"}, {"status": "affected", "version": "a8f75cb348fd52e7a5cf25991cdf9c89fb0cfd41", "lessThan": "0ecc1c70dcd32c0f081b173a1a5d89952686f271", "versionType": "git"}], "programFiles": ["drivers/bus/mhi/core/main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"status": "unaffected", "version": "0", "lessThan": "5.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.12.3", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/bus/mhi/core/main.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a99b661c3187365f81026d89b1133a76cd2652b3"}, {"url": "https://git.kernel.org/stable/c/0ecc1c70dcd32c0f081b173a1a5d89952686f271"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: core: Fix invalid error returning in mhi_queue\n\nmhi_queue returns an error when the doorbell is not accessible in\nthe current state. This can happen when the device is in non M0\nstate, like M3, and needs to be waken-up prior ringing the DB. This\ncase is managed earlier by triggering an asynchronous M3 exit via\ncontroller resume/suspend callbacks, that in turn will cause M0\ntransition and DB update.\n\nSo, since it's not an error but just delaying of doorbell update, there\nis no reason to return an error.\n\nThis also fixes a use after free error for skb case, indeed a caller\nqueuing skb will try to free the skb if the queueing fails, but in\nthat case queueing has been done."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.12.3", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.13", "versionStartIncluding": "5.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:18.172Z"}}}, "cveMetadata": {"cveId": "CVE-2021-46969", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:45:18.172Z", "dateReserved": "2024-02-27T18:42:55.943Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-27T18:47:05.463Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bus/mhi/core/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a99b661c3187365f81026d89b1133a76cd2652b3", "status": "affected", "version": "a8f75cb348fd52e7a5cf25991cdf9c89fb0cfd41", "versionType": "git"}, {"lessThan": "0ecc1c70dcd32c0f081b173a1a5d89952686f271", "status": "affected", "version": "a8f75cb348fd52e7a5cf25991cdf9c89fb0cfd41", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bus/mhi/core/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F9D6B2DE-7E4A-4B3B-9AEE-3A2C5F23DA32", "versionEndExcluding": "5.12.3", "versionStartIncluding": "5.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: core: Fix invalid error returning in mhi_queue\n\nmhi_queue returns an error when the doorbell is not accessible in\nthe current state. This can happen when the device is in non M0\nstate, like M3, and needs to be waken-up prior ringing the DB. This\ncase is managed earlier by triggering an asynchronous M3 exit via\ncontroller resume/suspend callbacks, that in turn will cause M0\ntransition and DB update.\n\nSo, since it's not an error but just delaying of doorbell update, there\nis no reason to return an error.\n\nThis also fixes a use after free error for skb case, indeed a caller\nqueuing skb will try to free the skb if the queueing fails, but in\nthat case queueing has been done."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: bus: mhi: core: corrige el error no v\u00e1lido que regresa en mhi_queue mhi_queue devuelve un error cuando no se puede acceder al timbre en el estado actual. Esto puede suceder cuando el dispositivo no est\u00e1 en un estado M0, como M3, y es necesario activarlo antes de llamar a la base de datos. Este caso se gestiona anteriormente activando una salida asincr\u00f3nica de M3 a trav\u00e9s de devoluciones de llamada de reanudaci\u00f3n/suspensi\u00f3n del controlador, que a su vez provocar\u00e1 la transici\u00f3n de M0 y la actualizaci\u00f3n de la base de datos. Entonces, dado que no es un error sino simplemente un retraso en la actualizaci\u00f3n del timbre, no hay raz\u00f3n para devolver un error. Esto tambi\u00e9n corrige un error de uso despu\u00e9s de la liberaci\u00f3n para el caso de skb; de hecho, una persona que llama al skb en cola intentar\u00e1 liberar el skb si la cola falla, pero en ese caso la cola ya se realiz\u00f3."}], "id": "CVE-2021-46969", "lastModified": "2026-08-04T10:16:38.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-46969", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:01:28.491057Z", "version": "2.0.3"}}]}, "published": "2024-02-27T19:04:07.260", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0ecc1c70dcd32c0f081b173a1a5d89952686f271"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a99b661c3187365f81026d89b1133a76cd2652b3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0ecc1c70dcd32c0f081b173a1a5d89952686f271"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a99b661c3187365f81026d89b1133a76cd2652b3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bus: mhi: core: Fix invalid error returning in mhi_queue", "id": "2266798", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2266798"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbus: mhi: core: Fix invalid error returning in mhi_queue\nmhi_queue returns an error when the doorbell is not accessible in\nthe current state. This can happen when the device is in non M0\nstate, like M3, and needs to be waken-up prior ringing the DB. This\ncase is managed earlier by triggering an asynchronous M3 exit via\ncontroller resume/suspend callbacks, that in turn will cause M0\ntransition and DB update.\nSo, since it's not an error but just delaying of doorbell update, there\nis no reason to return an error.\nThis also fixes a use after free error for skb case, indeed a caller\nqueuing skb will try to free the skb if the queueing fails, but in\nthat case queueing has been done."], "name": "CVE-2021-46969", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-46969\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-46969\nhttps://lore.kernel.org/linux-cve-announce/2024022720-CVE-2021-46969-3263@gregkh/T/#u"], "statement": "No Red Hat Products are affected by this vulnerability.", "threat_severity": "Low"}

{}