Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2021-4454— can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于j1939_session_deactivate中错误的WARN_ON_ONCE检查。

CVSS 7.5 · High EPSS 0.59% · P48 Updated Oct 16, 2026

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 16

Vendor	Product	Version Range	Status
Linux	Linux	`7eef18c0479ba5d9f54fba30cd77c233ebca3eb1< 6950df42a03c9ac9290503ced3f371199cb68fa9`	affected
		`55dd22c5d029423f513fd849e633adf0e9c10d0c< b6d44072117bba057d50f7a2f96e5d070c65926d`	affected
		`0c71437dd50dd687c15d8ca80b3b68f10bb21d63< 9ab896775f98ff54b68512f345eed178bf961084`	affected
		`0c71437dd50dd687c15d8ca80b3b68f10bb21d63< 1740a1e45eee65099a92fb502e1e67e63aad277d`	affected
		`0c71437dd50dd687c15d8ca80b3b68f10bb21d63< d0553680f94c49bbe0e39eb50d033ba563b4212d`	affected
		`5e1fc537c1be332aef9621ca9146aeb3ba59522f`	affected
		`5.4.138< 5.4.232`	affected
		`5.10.56< 5.10.168`	affected
… +8 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-4454

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate The conclusion "j1939_session_deactivate() should be called with a session ref-count of at least 2" is incorrect. In some concurrent scenarios, j1939_session_deactivate can be called with the session ref-count less than 2. But there is not any problem because it will check the session active state before session putting in j1939_session_deactivate_locked(). Here is the concurrent scenario of the problem reported by syzbot and my reproduction log. cpu0 cpu1 j1939_xtp_rx_eoma j1939_xtp_rx_abort_one j1939_session_get_by_addr [kref == 2] j1939_session_get_by_addr [kref == 3] j1939_session_deactivate [kref == 2] j1939_session_put [kref == 1] j1939_session_completed j1939_session_deactivate WARN_ON_ONCE(kref < 2) ===================================================== WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70 CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:j1939_session_deactivate+0x5f/0x70 Call Trace: j1939_session_deactivate_activate_next+0x11/0x28 j1939_xtp_rx_eoma+0x12a/0x180 j1939_tp_recv+0x4a2/0x510 j1939_can_recv+0x226/0x380 can_rcv_filter+0xf8/0x220 can_receive+0x102/0x220 ? process_backlog+0xf0/0x2c0 can_rcv+0x53/0xf0 __netif_receive_skb_one_core+0x67/0x90 ? process_backlog+0x97/0x2c0 __netif_receive_skb+0x22/0x80

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于j1939_session_deactivate中错误的WARN_ON_ONCE检查。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	7eef18c0479ba5d9f54fba30cd77c233ebca3eb1 ~ 6950df42a03c9ac9290503ced3f371199cb68fa9	-
Linux	Linux	5.14	-

II. Public POCs for CVE-2021-4454

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2021-4454

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2021-4454

Same Patch Batch · Linux · 2025-03-27 · 124 CVEs total

CVE-2023-53006	9.8 CRITICAL	cifs: Fix oops due to uncleared server->smbd_conn in reconnect
CVE-2025-21876	8.8 HIGH	iommu/vt-d: Fix suspicious RCU usage
CVE-2025-21890	8.2 HIGH	idpf: fix checksums set in idpf_rx_rsc()
CVE-2025-21887	7.8 HIGH	ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
CVE-2023-53033	7.8 HIGH	netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
CVE-2025-21889	7.8 HIGH	perf/core: Add RCU read lock protection to perf_iterate_ctx()
CVE-2023-52930	7.8 HIGH	drm/i915: Fix potential bit_17 double-free
CVE-2023-52931	7.8 HIGH	drm/i915: Avoid potential vm use-after-free
CVE-2023-52934	7.8 HIGH	mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups
CVE-2023-52935	7.8 HIGH	mm/khugepaged: fix ->anon_vma race
CVE-2023-53009	7.8 HIGH	drm/amdkfd: Add sync after creating vram bo
CVE-2023-52999	7.8 HIGH	net: fix UaF in netns ops registration error path
CVE-2023-52973	7.8 HIGH	vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
CVE-2023-52981	7.8 HIGH	drm/i915: Fix request ref counting during error capture & debugfs dump
CVE-2023-52983	7.8 HIGH	block, bfq: fix uaf for bfqq in bic_set_bfqq()
CVE-2023-52975	7.8 HIGH	scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
CVE-2023-52974	7.8 HIGH	scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
CVE-2023-52987	7.8 HIGH	ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write()
CVE-2025-21867	7.8 HIGH	bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
CVE-2023-52988	7.8 HIGH	ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()

Showing top 20 of 124 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux