CVE-2021-46933

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.15.3-1

Description The vulnerability is related to a refcount underflow in the ffs data clear function of the usb f fs module. When userland closes ep0 and then unmounts f fs, ffs data clear is indirectly called twice, causing eventfd ctx put to be called multiple times and resulting in a refcount underflow. This can lead to a use-after-free error. The issue is resolved by NULL-ifying ffs eventfd to prevent extraneous eventfd ctx put calls.

Recommendations To resolve the issue, update the Linux kernel to version 5.15.3-1 or later. As a temporary workaround, consider disabling the ffs data clear function until a patch is available. However, this may have unintended consequences and should be used with caution.

Note: The provided information does not specify the exact versions affected, but based on the data, it appears that versions prior to 5.15.3-1 are vulnerable.