{
  "cveId": "CVE-2021-46929",
  "url": "https://patchblox.com/security/cve/CVE-2021-46929",
  "summary": "CVE-2021-46929 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-46929, released February 27, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  sctp: use call_rcu to free endpoint  This patch...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  sctp: use call_rcu to free endpoint  This patch is to delay the endpoint free by calling call_rcu() to fix another use-after-free issue in sctp_sock_dump():    BUG: KASAN: use-after-free in __lock_acquire\u002B0x36d9/0x4c20   Call Trace:     __lock_acquire\u002B0x36d9/0x4c20 kernel/locking/lockdep.c:3218     lock_acquire\u002B0x1ed/0x520 kernel/locking/lockdep.c:3844     __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]     _raw_spin_lock_bh\u002B0x31/0x40 kernel/locking/spinlock.c:168     spin_lock_bh include/linux/spinlock.h:334 [inline]     __lock_sock\u002B0x203/0x350 net/core/sock.c:2253     lock_sock_nested\u002B0xfe/0x120 net/core/sock.c:2774     lock_sock include/net/sock.h:1492 [inline]     sctp_sock_dump\u002B0x122/0xb20 net/sctp/diag.c:324     sctp_for_each_transport\u002B0x2b5/0x370 net/sctp/socket.c:5091     sctp_diag_dump\u002B0x3ac/0x660 net/sctp/diag.c:527     __inet_diag_dump\u002B0xa8/0x140 net/ipv4/inet_diag.c:1049     inet_diag_dump\u002B0x9b/0x110 net/ipv4/inet_diag.c:1065     netlink_dump\u002B0x606/0x1080 net/netlink/af_netlink.c:2244     __netlink_dump_start\u002B0x59a/0x7c0 net/netlink/af_netlink.c:2352     netlink_dump_start include/linux/netlink.h:216 [inline]     inet_diag_handler_cmd\u002B0x2ce/0x3f0 net/ipv4/inet_diag.c:1170     __sock_diag_cmd net/core/sock_diag.c:232 [inline]     sock_diag_rcv_msg\u002B0x31d/0x410 net/core/sock_diag.c:263     netlink_rcv_skb\u002B0x172/0x440 net/netlink/af_netlink.c:2477     sock_diag_rcv\u002B0x2a/0x40 net/core/sock_diag.c:274  This issue occurs when asoc is peeled off and the old sk is freed after getting it by asoc-\u003Ebase.sk and before calling lock_sock(sk).  To prevent the sk free, as a holder of the sk, ep should be alive when calling lock_sock(). This patch uses call_rcu() and moves sock_put and ep free into sctp_endpoint_destroy_rcu(), so that it\u0027s safe to try to hold the ep under rcu_read_lock in sctp_transport_traverse_process().  If sctp_endpoint_hold() returns true, it means this ep is still alive and we have held it and can continue to dump it; If it returns false, it means this ep is dead and can be freed after rcu_read_unlock, and we should skip it.  In sctp_sock_dump(), after locking the sk, if this ep is different from tsp-\u003Easoc-\u003Eep, it means during this dumping, this asoc was peeled off before calling lock_sock(), and the sk should be skipped; If this ep is the same with tsp-\u003Easoc-\u003Eep, it means no peeloff happens on this asoc, and due to lock_sock, no peeloff will happen either until release_sock.  Note that delaying endpoint free won\u0027t delay the port release, as the port release happens in sctp_endpoint_destroy() before calling call_rcu(). Also, freeing endpoint by call_rcu() makes it safe to access the sk by asoc-\u003Ebase.sk in sctp_assocs_seq_show() and sctp_rcv().  Thanks Jones to bring this issue up.  v1-\u003Ev2:   - improve the changelog.   - add kfree(ep) into sctp_endpoint_destroy_rcu(), as Jakub noticed.",
  "published": "2024-02-27T10:15:07Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.0026,
  "epssPercentile": 0.17814,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-46929",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-46929",
      "released": "2024-02-27T10:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-46929",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-46929",
      "released": "2024-02-27T10:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-46929",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-46929",
      "released": "2024-02-27T10:15:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}