CVE-2021-37159: Debian Linux

Medium severity, CVSS 6.4. EPSS: 0.4% chance of exploitation in the next 30 days.

hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.

Affected products

• Debian Debian Linux: version 9.0 only
• Linux Linux Kernel: up to and including 5.13.4
• Oracle Communications Cloud Native Core Binding Support Function: version 22.1.3 only
• Oracle Communications Cloud Native Core Network Exposure Function: version 22.1.1 only
• Oracle Communications Cloud Native Core Policy: version 22.2.0 only

Published 2021-07-21. Last modified 2026-10-08.