7.5

CVE-2021-4454: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

Modified
AliasesUBUNTU-CVE-2021-4454DEBIAN-CVE-2021-4454
Published 27-03-2025Last modified 15-10-2026

Vulnerability summary

CVE-2021-4454 is a high (CVSS 7.5) vulnerability in linux. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 48.2% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.59%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 4
SUSE-SU-2025:1176-1SUSE-SU-2025:1183-1SUSE-SU-2025:1195-1SUSE-SU-2025:1241-1

Timeline

  1. 27-03-2025
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate The conclusion "j1939_session_deactivate() should be called with a session ref-count of at least 2" is incorrect. In some concurrent scenarios, j1939_session_deactivate can be called with the session ref-count less than 2. But there is not any problem because it will check the session active state before session putting in j1939_session_deactivate_locked(). Here is the concurrent scenario of the problem reported by syzbot and my reproduction log. cpu0 cpu1 j1939_xtp_rx_eoma j1939_xtp_rx_abort_one j1939_session_get_by_addr [kref == 2] j1939_session_get_by_addr [kref == 3] j1939_session_deactivate [kref == 2] j1939_session_put [kref == 1] j1939_session_completed j1939_session_deactivate WARN_ON_ONCE(kref < 2) ===================================================== WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70 CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:j1939_session_deactivate+0x5f/0x70 Call Trace: j1939_session_deactivate_activate_next+0x11/0x28 j1939_xtp_rx_eoma+0x12a/0x180 j1939_tp_recv+0x4a2/0x510 j1939_can_recv+0x226/0x380 can_rcv_filter+0xf8/0x220 can_receive+0x102/0x220 ? process_backlog+0xf0/0x2c0 can_rcv+0x53/0xf0 __netif_receive_skb_one_core+0x67/0x90 ? process_backlog+0x97/0x2c0 __netif_receive_skb+0x22/0x80

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.59%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.58% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu109 products
  • linux< 5.4.0-149.166 | < 5.15.0-72.79
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.4.0-1102.110 | < 5.15.0-1036.40
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 7eef18c0479ba5d9f54fba30cd77c233ebca3eb1, < 6950df42a03c9ac9290503ced3f371199cb68fa9 | ≥ 55dd22c5d029423f513fd849e633adf0e9c10d0c, < b6d44072117bba057d50f7a2f96e5d070c65926d | ≥ 0c71437dd50dd687c15d8ca80b3b68f10bb21d63, < 9ab896775f98ff54b68512f345eed178bf961084 | ≥ 0c71437dd50dd687c15d8ca80b3b68f10bb21d63, < 1740a1e45eee65099a92fb502e1e67e63aad277d | ≥ 0c71437dd50dd687c15d8ca80b3b68f10bb21d63, < d0553680f94c49bbe0e39eb50d033ba563b4212d | 5e1fc537c1be332aef9621ca9146aeb3ba59522f | ≥ 5.4.138, < 5.4.232 | ≥ 5.10.56, < 5.10.168 | ≥ 5.13.8, < 5.14 | 5.14
  • linux_kernelEOL≥ 5.4.138, < 5.4.232 | ≥ 5.10.56, < 5.10.168 | ≥ 5.13.8, < 5.14 | ≥ 5.14.1, < 5.15.93 | ≥ 5.16, < 6.1.11 | 5.14 | 5.14:rc4 | 5.14:rc5 | 5.14:rc6 | 5.14:rc7 | 6.2:rc1 | 6.2:rc2 | 6.2:rc3 | 6.2:rc4 | 6.2:rc5 | 6.2:rc6
Debian1 product
  • linux< 6.1.11-1

3 vendors · 112 products

References

9 links