CVE-2021-46966: ACPI: custom_method: fix potential use-after-free issue

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-27 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: custom_method: fix potential use-after-free issue In cm_write(), buf is always freed when reaching the end of the function. If the requested count is less than table.length, the allocated buffer will be freed but subsequent calls to cm_write() will still try to access it. Remove the unconditional kfree(buf) at the end of the function and set the buf to NULL in the -EINVAL error path to match the rest of function.

Affected products

Linux kernel: from 4.4.195 before 4.4.269; from 4.9.195 before 4.9.269; from 4.14.147 before 4.14.233; from 4.19.77 before 4.19.191; from 5.4 before 5.4.118; from 5.5 before 5.10.36 — fixed in 4.14.233, 4.19.191, 4.4.269, 4.9.269, 5.10.36, 5.11.20

How to fix

Upgrade to a fixed version: Linux kernel 4.14.233, 4.19.191, 4.4.269, 4.9.269. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-46966 or the next vulnerability affects your stack