CVE-2021-46981: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-46981 is a vulnerability in the Linux kernel's Network Block Device (NBD) subsystem. The issue involves a NULL pointer dereference in the flush_workqueue function when handling NBD device disconnection. This vulnerability was discovered when opening and disconnecting /dev/nbdX devices, where config_refs would be 1 but pointers in nbd_device remain null, leading to a reference to a null recv_workq (NVD).

The vulnerability occurs in the nbd_disconnect_and_put function where flush_workqueue is called without checking if recv_workq is initialized. This results in a NULL pointer dereference when attempting to access address 0x20 in supervisor mode. The issue manifests as a kernel NULL pointer dereference with error code 0x0002, indicating a not-present page access in kernel mode. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a kernel crash (denial of service) through a NULL pointer dereference. The issue affects the system's stability and availability, particularly when NBD devices are being disconnected. The vulnerability has been classified as CWE-476 (NULL Pointer Dereference) (NVD).

The vulnerability requires local access and can be triggered through the NBD device disconnection process. The exploit path involves opening /dev/nbdX first, where config_refs becomes 1 and pointers in nbd_device are still null, followed by disconnecting /dev/nbdX, which leads to referencing a null recv_workq (Kernel Patch).

The fix involves adding a NULL pointer check (if (nbd->recv_workq)) before calling flush_workqueue in the nbd_disconnect_and_put function. This patch has been implemented across multiple kernel versions, including 5.4.x through 5.12.x. The fix was backported to various stable kernel branches to address the vulnerability (Kernel Patch).