CVE-2021-46966: ACPI: custom_method: fix potential use-after-free issue
In the Linux kernel, the following vulnerability has been resolved:
ACPI: custommethod: fix potential use-after-free issue
In cmwrite(), buf is always freed when reaching the end of the function. If the requested count is less than table.length, the allocated buffer will be freed but subsequent calls to cmwrite() will still try to access it.
Remove the unconditional kfree(buf) at the end of the function and set the buf to NULL in the -EINVAL error path to match the rest of function.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-46966?
CVE-2021-46966 has a severity rating that indicates a medium impact vulnerability in the Linux kernel.
How do I fix CVE-2021-46966?
To fix CVE-2021-46966, upgrade to the patched versions of the Linux kernel, specifically versions 5.10.223-1, 5.10.226-1, 6.1.123-1, or later.
What systems are affected by CVE-2021-46966?
CVE-2021-46966 affects a variety of Linux kernel versions between 4.4.195 and 5.12.3.
What type of vulnerability is CVE-2021-46966?
CVE-2021-46966 is classified as a use-after-free vulnerability within the Linux kernel.
Is there a workaround for CVE-2021-46966?
There is no recommended workaround for CVE-2021-46966; patching the system is the recommended mitigation.