CVE-2021-46966

What it actually does

Use-after-free in cm_write() where buf is unconditionally freed at function end, but subsequent calls still reference it when partial writes (count < table.length) occur, enabling access to freed kernel memory.

Why it matters to the business

Local attackers could corrupt kernel memory on Linux systems, risking crashes, data loss, or full system takeover if the debug interface is exposed; widespread impact due to Linux kernel prevalence in servers and devices.

How an attack unfolds

An attacker with write access to the ACPI custom_method debug interface performs successive partial writes smaller than the expected table length, causing the buffer to be freed then dereferenced on later calls to achieve memory corruption or code execution.

How to fix it

Upgrade to a patched Linux kernel version containing the commit that removes the unconditional kfree(buf) and properly nulls buf on the EINVAL path.

How to confirm the fix worked

Verify the running kernel source includes the fix (no unconditional kfree at cm_write end and buf=NULL on EINVAL) or test by exercising partial writes and confirming no UAF warnings in debug logs.

Typical attack path

1. Obtain local access and ensure the ACPI custom_method debug interface is writable
2. Open the interface file and issue a write smaller than table.length to allocate and free buf
3. Perform additional writes that dereference the now-freed buffer
4. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for use-after-free warnings, slab corruption, or oops traces referencing cm_write or ACPI custom_method; inspect audit logs for unexpected writes to debugfs ACPI paths.

What your security team should do

• Apply the upstream kernel patch or distribution update immediately on all systems
• Disable the ACPI custom_method debug interface unless explicitly required
• Harden kernel configurations to restrict debugfs access to privileged users only
• Monitor kernel logs for ACPI-related faults as an interim detection measure