CVE-2021-46973

What it actually does

Use-after-free in Linux kernel QRTR MHI send path where skb can be freed by ul_callback immediately after queuing, allowing subsequent dereference of freed memory and potential sk refcount underflow.

Why it matters to the business

Local attackers may crash systems or execute arbitrary code on Linux hosts using QRTR/MHI networking, leading to denial of service, privilege escalation, or full host compromise in environments with affected kernel versions.

How an attack unfolds

An attacker with local access crafts network operations that queue an skb for MHI transmission; the immediate ul_callback frees the skb and drops sk references before the caller dereferences the skb or increments the refcount, triggering the use-after-free.

How to fix it

Update the Linux kernel to a version containing the fix for this use-after-free in the QRTR MHI send path; rebuild and reboot affected hosts with the patched kernel.

How to confirm the fix worked

Confirm the running kernel version includes the commit resolving the ordering of skb dereference and sk refcount increment before MHI queuing; inspect kernel source or changelog for the QRTR MHI send fix.

Typical attack path

1. Obtain local unprivileged access to a Linux system with QRTR and MHI enabled
2. Trigger QRTR socket operations that queue skb for MHI transmission
3. Force immediate invocation of MHI ul_callback to free the skb
4. Trigger subsequent skb dereference or sk refcount operation on the freed object
5. Achieve memory corruption leading to crash or code execution

How to detect it

Review kernel logs for oops/panic traces referencing qrtr, mhi, skb, or use-after-free in net/qrtr paths; correlate with unusual local process activity involving sockets or modem interfaces around the time of the event.

What your security team should do

• Prioritize kernel updates on all systems exposing QRTR or MHI interfaces
• Restrict local user access and capabilities on multi-tenant or high-value hosts until patched
• Monitor for kernel oops or crashes involving qrtr or mhi modules as potential exploitation indicators