CVE-2021-46966: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ACPI: custom_method: fix potential use-after-free issue In cm_write(), buf is always freed when reaching the end of the function. If the requested count is less than table.length, the allocated buffer will be freed but subsequent calls to cm_write() will still try to access it. Remove the unconditional kfree(buf) at the end of the function and set the buf to NULL in the -EINVAL error path to match the rest of function.

Affected products

• Linux Linux Kernel: from 4.4.195, before 4.4.269 (fixed in 4.4.269); from 4.9.195, before 4.9.269 (fixed in 4.9.269); from 4.14.147, before 4.14.233 (fixed in 4.14.233); from 4.19.77, before 4.19.191 (fixed in 4.19.191); from 5.4, before 5.4.118 (fixed in 5.4.118); from 5.5, before 5.10.36 (fixed in 5.10.36); …

Published 2024-02-27. Last modified 2026-06-17.