# CVE-2021-4454: linux: In the Linux kernel, the following vulnerability has been resolved:  can: j1939: fix errant WARN_ON_ONCE in j1939_ses...

CVE-2021-4454 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-4454, released March 27, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2021-4454
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0059
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 27, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate  The conclusion "j1939_session_deactivate() should be called with a session ref-count of at least 2" is incorrect. In some concurrent scenarios, j1939_session_deactivate can be called with the session ref-count less than 2. But there is not any problem because it will check the session active state before session putting in j1939_session_deactivate_locked().  Here is the concurrent scenario of the problem reported by syzbot and my reproduction log.          cpu0                            cpu1                                 j1939_xtp_rx_eoma j1939_xtp_rx_abort_one                                 j1939_session_get_by_addr [kref == 2] j1939_session_get_by_addr [kref == 3] j1939_session_deactivate [kref == 2] j1939_session_put [kref == 1] 				j1939_session_completed 				j1939_session_deactivate 				WARN_ON_ONCE(kref < 2)  ===================================================== WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70 CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:j1939_session_deactivate+0x5f/0x70 Call Trace:  j1939_session_deactivate_activate_next+0x11/0x28  j1939_xtp_rx_eoma+0x12a/0x180  j1939_tp_recv+0x4a2/0x510  j1939_can_recv+0x226/0x380  can_rcv_filter+0xf8/0x220  can_receive+0x102/0x220  ? process_backlog+0xf0/0x2c0  can_rcv+0x53/0xf0  __netif_receive_skb_one_core+0x67/0x90  ? process_backlog+0x97/0x2c0  __netif_receive_skb+0x22/0x80

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.11-1 | [DEBIAN-CVE-2021-4454](https://patchblox.com/security/data/fix/linux/debian-cve-2021-4454.md) | Mar 27, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.1.11-1 | [DEBIAN-CVE-2021-4454](https://patchblox.com/security/data/fix/linux/debian-cve-2021-4454.md) | Mar 27, 2025 |
| Linux | linux Debian 14 | 6.1.11-1 | [DEBIAN-CVE-2021-4454](https://patchblox.com/security/data/fix/linux/debian-cve-2021-4454.md) | Mar 27, 2025 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.