CVE-2021-46969

What it actually does

Incorrect error return from mhi_queue when the doorbell is inaccessible causes callers to free an SKB that has already been successfully queued, resulting in a use-after-free condition in the Linux kernel MHI bus implementation.

Why it matters to the business

Linux-based systems relying on MHI hardware may experience kernel memory corruption, crashes, or potential privilege escalation leading to service disruption and increased operational risk until patched.

How an attack unfolds

An attacker with local access triggers device state transitions that make the doorbell inaccessible, causing mhi_queue to erroneously return an error; the caller then frees the already-queued SKB, allowing the attacker to reclaim and manipulate the freed memory for code execution.

How to fix it

Update the Linux kernel to a version containing the fix for invalid error handling in mhi_queue; apply the upstream commit that removes the erroneous error return and prevents the use-after-free on SKB queuing.

How to confirm the fix worked

Confirm the kernel source contains the corrected mhi_queue logic that avoids returning an error for delayed doorbell updates; test by exercising MHI state transitions and verifying no use-after-free reports in kernel logs.

Typical attack path

1. Obtain local code execution on a Linux system with MHI bus hardware
2. Force MHI controller into non-M0 states such as M3
3. Invoke mhi_queue with an SKB while the doorbell remains inaccessible
4. Trigger the erroneous error return and subsequent skb free by the caller
5. Reclaim the freed SKB memory and corrupt kernel structures for privilege escalation

How to detect it

Review kernel logs for use-after-free warnings or crashes involving mhi_queue or SKB handling during MHI state transitions; inspect audit logs for unusual local process activity around MHI device resume or suspend events.

What your security team should do

• Prioritize kernel updates on all systems exposing MHI bus functionality
• Monitor vendor advisories for backported fixes in supported distributions
• Restrict local access on systems until patches are deployed