{"id":"CVE-2021-4454","revision":"cd689e43dcff4260b9d87a7ccf8c4f20","records":[{"revision":"cd689e43dcff4260b9d87a7ccf8c4f20","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2021-4454","aliases":[],"title":"can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate\n\nThe conclusion \"j1939_session_deactivate() should be called with a\nsession ref-count of at least 2\" is incorrect. In some concurrent\nscenarios, j1939_session_deactivate can be called with the session\nref-count less than 2. But there is not any problem because it\nwill check the session active state before session putting in\nj1939_session_deactivate_locked().\n\nHere is the concurrent scenario of the problem reported by syzbot\nand my reproduction log.\n\n        cpu0                            cpu1\n                                j1939_xtp_rx_eoma\nj1939_xtp_rx_abort_one\n                                j1939_session_get_by_addr [kref == 2]\nj1939_session_get_by_addr [kref == 3]\nj1939_session_deactivate [kref == 2]\nj1939_session_put [kref == 1]\n\t\t\t\tj1939_session_completed\n\t\t\t\tj1939_session_deactivate\n\t\t\t\tWARN_ON_ONCE(kref < 2)\n\n=====================================================\nWARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70\nCPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014\nRIP: 0010:j1939_session_deactivate+0x5f/0x70\nCall Trace:\n j1939_session_deactivate_activate_next+0x11/0x28\n j1939_xtp_rx_eoma+0x12a/0x180\n j1939_tp_recv+0x4a2/0x510\n j1939_can_recv+0x226/0x380\n can_rcv_filter+0xf8/0x220\n can_receive+0x102/0x220\n ? process_backlog+0xf0/0x2c0\n can_rcv+0x53/0xf0\n __netif_receive_skb_one_core+0x67/0x90\n ? process_backlog+0x97/0x2c0\n __netif_receive_skb+0x22/0x80","state":0,"publishedAt":"2025-03-27T16:37:09.381+00:00","modifiedAt":"2026-10-15T21:21:06.266+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/can/j1939/transport.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7eef18c0479ba5d9f54fba30cd77c233ebca3eb1\",\n                            \"lessThan\": \"6950df42a03c9ac9290503ced3f371199cb68fa9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"55dd22c5d029423f513fd849e633adf0e9c10d0c\",\n                            \"lessThan\": \"b6d44072117bba057d50f7a2f96e5d070c65926d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0c71437dd50dd687c15d8ca80b3b68f10bb21d63\",\n                            \"lessThan\": \"9ab896775f98ff54b68512f345eed178bf961084\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0c71437dd50dd687c15d8ca80b3b68f10bb21d63\",\n                            \"lessThan\": \"1740a1e45eee65099a92fb502e1e67e63aad277d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0c71437dd50dd687c15d8ca80b3b68f10bb21d63\",\n                            \"lessThan\": \"d0553680f94c49bbe0e39eb50d033ba563b4212d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5e1fc537c1be332aef9621ca9146aeb3ba59522f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.4.138\",\n                            \"lessThan\": \"5.4.232\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.56\",\n                            \"lessThan\": \"5.10.168\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.13.8\",\n                            \"lessThan\": \"5.14\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/can/j1939/transport.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.232\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.168\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.93\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.11\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/6950df42a03c9ac9290503ced3f371199cb68fa9","https://git.kernel.org/stable/c/b6d44072117bba057d50f7a2f96e5d070c65926d","https://git.kernel.org/stable/c/9ab896775f98ff54b68512f345eed178bf961084","https://git.kernel.org/stable/c/1740a1e45eee65099a92fb502e1e67e63aad277d","https://git.kernel.org/stable/c/d0553680f94c49bbe0e39eb50d033ba563b4212d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-4454","license":"CVE Program Terms of Use","key":"cve-program:CVE-2021-4454","identifiers":["CVE-2021-4454"]},"retained":false,"historicalAffected":[]}],"coverage":[]}