CVE-2021-46905

What it actually does

The vulnerability triggers an unconditional NULL pointer dereference in the hso serial driver on every device disconnect because the serial device table is accessed after hso_serial_tty_unregister() releases the minor.

Why it matters to the business

Systems using affected USB modem hardware can experience kernel crashes on routine device disconnect, resulting in denial of service, unplanned reboots, and potential loss of in-flight work.

How an attack unfolds

An attacker with local access causes or waits for an hso device disconnect event; the flawed code path then dereferences a NULL pointer, crashing the kernel.

How to fix it

Update the Linux kernel to a version containing the fix for the hso NULL-deref regression introduced by commit 8a12f8836145; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel source includes the hso disconnect fix; perform controlled connect/disconnect cycles on hso hardware and verify absence of NULL dereference oops in dmesg.

Typical attack path

1. Obtain local user access on a system with an hso USB device present
2. Trigger or observe device disconnect (plug/unplug or driver unload)
3. Force the kernel to execute the post-unregister table access in hso
4. Trigger kernel panic / oops

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference oops mentioning hso_serial_tty_unregister or hso serial table access during device removal events.

What your security team should do

• Identify hosts exposing the hso driver and schedule kernel updates
• Harden local access controls to reduce the chance of triggering the bug
• Add kernel oops monitoring for hso-related crashes as a temporary detection measure