CVE-2021-4454

A low severity flaw was found in the Linux kernel's SAE J1939 CAN transport layer (net/can/j1939). Due to a race in session reference-count handling, concurrent J1939 transport processing (for example a session completing on one CPU while another session is aborted on another) can cause j1939_session_deactivate() to be invoked with a session reference count below the previously assumed minimum of 2, triggering an errant WARN_ON_ONCE warning in the kernel. Upstream analysis determined that this condition causes no functional problem beyond the warning, because the session's active state is checked before the session reference is released in j1939_session_deactivate_locked(). A local user with access to a system using the J1939 protocol could trigger this spurious kernel warning, with a low availability impact; there is no impact on confidentiality or integrity. Red Hat Product Security rated this flaw Low (CVSS 3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). The CVE.org record scores this issue as Important (7.5) using a network attack vector, which does not reflect the local nature of the defect, since the J1939 code path is only reachable through locally attached CAN networking. Red Hat Enterprise Linux 6, 7, 8, and 10 are not affected because the vulnerable code is not present in their kernels. In the affected Red Hat Enterprise Linux 9 and Red Hat In-Vehicle OS kernel builds, the fix is deferred: the flaw manifests only as a spurious kernel warning rather than memory corruption or data damage, so it is being addressed through the regular deferred-update process rather than an immediate update. The residual risk is limited to a kernel warning being triggered on systems actively using the J1939 CAN protocol.