CVE-2021-46904

What it actually does

A race in minor number allocation for hso tty devices allows multiple ttys to receive the same minor, causing the second unregistration attempt to dereference a null pointer and crash the kernel.

Why it matters to the business

Local users can trigger kernel crashes that render the system unavailable, interrupting services and requiring manual recovery or reboot.

How an attack unfolds

An attacker with local access opens multiple hso tty devices in quick succession; the flawed get_free_serial_index logic hands out the same minor to each, so the second close path performs an unregistration on an already-freed structure and hits the null dereference.

How to fix it

Upgrade the Linux kernel to a version containing the fix that renames get_free_serial_index to obtain_minor (immediate assignment) and set_serial_by_index to release_minor; apply the stable or distribution backport that resolves the double-unregistration condition.

How to confirm the fix worked

Confirm the running kernel contains the renamed obtain_minor and release_minor functions and that the hso serial minor bitmap is updated atomically on allocation; re-test concurrent open/close sequences of hso ttys to verify no duplicate minors are issued.

Typical attack path

1. Obtain local shell or user context on a system with the hso driver loaded
2. Open several /dev/ttyHS* devices concurrently to trigger repeated minor allocation
3. Close the devices in an order that causes the second unregistration path to execute
4. Kernel dereferences null pointer and panics

How to detect it

Inspect kernel logs for null pointer dereference oops traces referencing hso_serial, tty_unregister_device, or get_free_serial_index; correlate with processes that opened multiple /dev/ttyHS* nodes shortly before the crash.

• hso_serial
• get_free_serial_index
• tty_unregister_device
• obtain_minor
• release_minor

What your security team should do

• Prioritize kernel updates on any hosts exposing the hso driver
• Restrict local user access to tty device nodes until patches are applied
• Monitor for kernel oops or panic logs containing hso or tty_unregister