CVE-2021-45095: 
Linux Kernel vulnerability analysis and mitigation

The vulnerability CVE-2021-45095 affects the Linux kernel through version 5.15.8, specifically in the pepsockaccept function within net/phonet/pep.c. This vulnerability was discovered in December 2021 and impacts the Phone Network protocol (PhoNet) implementation (NVD, Debian Security).

The vulnerability is characterized by a reference count leak in the pepsockaccept() function. Specifically, sockhold(sk) is invoked in pepsockaccept(), but _sockput(sk) is not invoked in subsequent failure branches when pepaccept_conn() returns non-zero (Kernel Commit). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

The reference count leak in the PhoNet protocol implementation could potentially lead to memory exhaustion, resulting in a denial of service condition (Ubuntu Security).

The vulnerability has been fixed in various Linux distributions through security updates. Debian has addressed this in version 5.10.92-1 for bullseye, 4.19.232-1 for buster, and 4.9.303-1 for stretch (Debian Security, Debian LTS). The fix involves adding the missing _sockput(sk) call in the error path of pepsockaccept() (Kernel Commit).