CVE-2021-46932: Input: appletouch - initialize work before device registration
In the Linux kernel, the following vulnerability has been resolved:
Input: appletouch - initialize work before device registration
Syzbot has reported warning in flushwork(). This warning is caused by work->func == NULL, which means missing work initialization.
This may happen, since inputdev->close() calls cancelworksync(&dev->work), but dev->work initalization happens after inputregisterdevice() call.
So this patch moves dev->work initialization before registering input device
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-46932?
CVE-2021-46932 is considered a high severity vulnerability due to its potential impact on the Linux kernel's integrity.
How do I fix CVE-2021-46932?
To fix CVE-2021-46932, update your Linux kernel to a version that is patched, such as 5.10.223-1 or later.
Which Linux kernel versions are affected by CVE-2021-46932?
CVE-2021-46932 affects Linux kernel versions from 2.6.23 up to 5.15.13, depending on the specific range.
What component is impacted by CVE-2021-46932?
CVE-2021-46932 impacts the appletouch driver functionality in the Linux kernel.
Is CVE-2021-46932 a remote vulnerability?
CVE-2021-46932 is primarily related to device initialization and may be exploited locally rather than remotely.