---
id: CVE-2021-4454
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

  The conclusion "j1939_session_deactivate() should be called with a
  session ref-count of at least 2" is …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

  The conclusion "j1939_session_deactivate() should be called with a
  session ref-count of at least 2" is …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-20
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.4.138, < 5.4.232'
  - 'linux_kernel >= 5.10.56, < 5.10.168'
  - 'linux_kernel >= 5.13.8, < 5.14'
  - 'linux_kernel >= 5.14.1, < 5.15.93'
  - 'linux_kernel >= 5.16, < 6.1.11'
  - linux_kernel = 5.14
  - linux_kernel = 6.2
patched:
  - linux_kernel 6.1.11
published: '2025-03-27'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:22.303'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-4454'
references:
  - url: 'https://git.kernel.org/stable/c/1740a1e45eee65099a92fb502e1e67e63aad277d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6950df42a03c9ac9290503ced3f371199cb68fa9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9ab896775f98ff54b68512f345eed178bf961084'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b6d44072117bba057d50f7a2f96e5d070c65926d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d0553680f94c49bbe0e39eb50d033ba563b4212d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-4454.json
  - url: 'https://access.redhat.com/security/cve/CVE-2021-4454'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2355529'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2021-4454'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-4454'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025032716-CVE-2021-4454-f4a4@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00591
epssPercentile: 0.48037
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:02:43.206452Z'
scores:
  nvd: 7.5
  vendor: 3.3
  cna: 7.5
ingestedAt: '2026-10-15T21:45:11.292Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

The conclusion "j1939_session_deactivate() should be called with a
session ref-count of at least 2" is incorrect. In some concurrent
scenarios, j1939_session_deactivate can be called with the session
ref-count less than 2. But there is not any problem because it
will check the session active state before session putting in
j1939_session_deactivate_locked().

Here is the concurrent scenario of the problem reported by syzbot
and my reproduction log.

        cpu0                            cpu1
                                j1939_xtp_rx_eoma
j1939_xtp_rx_abort_one
                                j1939_session_get_by_addr [kref == 2]
j1939_session_get_by_addr [kref == 3]
j1939_session_deactivate [kref == 2]
j1939_session_put [kref == 1]
				j1939_session_completed
				j1939_session_deactivate
				WARN_ON_ONCE(kref < 2)

=====================================================
WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70
CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
RIP: 0010:j1939_session_deactivate+0x5f/0x70
Call Trace:
 j1939_session_deactivate_activate_next+0x11/0x28
 j1939_xtp_rx_eoma+0x12a/0x180
 j1939_tp_recv+0x4a2/0x510
 j1939_can_recv+0x226/0x380
 can_rcv_filter+0xf8/0x220
 can_receive+0x102/0x220
 ? process_backlog+0xf0/0x2c0
 can_rcv+0x53/0xf0
 __netif_receive_skb_one_core+0x67/0x90
 ? process_backlog+0x97/0x2c0
 __netif_receive_skb+0x22/0x80

## Affected

- `linux_kernel >= 5.4.138, < 5.4.232`
- `linux_kernel >= 5.10.56, < 5.10.168`
- `linux_kernel >= 5.13.8, < 5.14`
- `linux_kernel >= 5.14.1, < 5.15.93`
- `linux_kernel >= 5.16, < 6.1.11`
- `linux_kernel = 5.14`
- `linux_kernel = 6.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.1.11`

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-4454.json)