CVE-2021-37159: n/a vulnerability

CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev wit...

hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 4, 2024, 01:16 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

CVE-2021-37159 is a Linux kernel memory-management flaw in the hso USB network driver. The source says kernels through 5.13.4 can mishandle network device cleanup, causing use-after-free and double-free conditions. Business urgency depends on whether affected kernels and this driver exist in your estate.

Executive priority

Prioritize this in normal kernel patch cycles, with faster handling for appliances or servers that expose USB networking functionality. No active exploitation is cited, but kernel memory-corruption bugs can carry operational risk if left unmanaged.

Technical view

In drivers/net/usb/hso.c, hso_free_net_device calls unregister_netdev without verifying NETREG_REGISTERED state. The CVE describes resulting use-after-free and double-free behavior. The bundle references upstream Linux commits plus Debian, Oracle, NetApp, and SUSE advisories, but provides no CVSS, CWE, or precise downstream affected-version matrix.

Likely exposure

Likely exposure is Linux systems or appliances running kernels through 5.13.4 where the hso USB network driver is present or used. Downstream exposure may include vendor-maintained Linux builds referenced by Debian, Oracle, NetApp, and SUSE. The supplied affected-products field is incomplete.

Exploitation context

The source bundle does not show active exploitation, and KEV is false. It also does not include exploitability details, prerequisites, or observed attacks. Treat this as a kernel memory-corruption issue requiring patch validation, not as confirmed internet-scale exploitation.

Researcher notes

Evidence is strongest for the root cause and upstream fix references. Evidence is weaker for exploitability, affected downstream versions, and impact severity because the bundle lacks CVSS, CWE, and detailed vendor version ranges.

Mitigation direction

Inventory Linux kernels and vendor appliances against the referenced advisories.
Apply vendor kernel updates that include the upstream Linux fixes.
Review Debian, Oracle, NetApp, and SUSE guidance where those platforms apply.
If hso is unnecessary, ask the vendor whether disabling it is supported.
Track remediation through normal kernel reboot and change-control processes.

Validation and detection

Confirm kernel versions are no longer vulnerable per vendor advisory.
Check whether the hso driver exists or is loaded on relevant systems.
Verify patched packages include the referenced upstream Linux commits.
Review asset records for Debian, Oracle, NetApp, and SUSE dependencies.
Document any unsupported systems requiring compensating vendor guidance.

Prepared: Jun 2, 2026, 19:19 UTC (UTC+00:00)
Confidence: medium
Sources: 10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-37159 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jul 21, 2021, 00:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
https://www.spinics.net/lists/linux-usb/msg202228.htmlCVE reference
[debian-lts-announce] 20211015 [SECURITY] [DLA 2785-1] linux-4.19 security updateCVE reference · mailing-list
[debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security updateCVE reference · mailing-list
https://www.oracle.com/security-alerts/cpujul2022.htmlCVE reference
https://security.netapp.com/advisory/ntap-20210819-0003/CVE reference
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a6ecfb39ba9d7316057cea823b196b734f6b18caCVE reference
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dcb713d53e2eadf42b878c12a471e74dc6ed3145CVE reference
https://bugzilla.suse.com/show_bug.cgi?id=1188601CVE reference

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.