{"cve":"CVE-2021-46973","nvd":{"published":"2024-02-27T19:04:07.457","modified":"2026-08-04T10:16:39.103","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: Avoid potential use after free in MHI send\n\nIt is possible that the MHI ul_callback will be invoked immediately\nfollowing the queueing of the skb for transmission, leading to the\ncallback decrementing the refcount of the associated sk and freeing the\nskb.\n\nAs such the dereference of skb and the increment of the sk refcount must\nhappen before the skb is queued, to avoid the skb to be used after free\nand potentially the sk to drop its last refcount..","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40","https://git.kernel.org/stable/c/47a017f33943278570c072bc71681809b2567b3a","https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80","https://git.kernel.org/stable/c/ea474054c2cc6e1284604b21361f475c7cc8c0a0","https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:45:59.823092188+00:00"},"epss":{"cve":"CVE-2021-46973","score":0.00231,"percentile":0.14037,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}