LiveActive security incident?Get immediate response
CVE Record

CVE-2021-38204: drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to c...

drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw can crash affected Linux systems when a physically present person removes a MAX3421 USB device in certain conditions. The business impact is availability loss, not data theft, based on the provided sources. Exposure is narrow because it depends on specific USB host controller hardware or driver use and physical proximity.

Executive priority

Prioritize patching for exposed embedded, lab, industrial, or physically accessible Linux systems using MAX3421 USB hardware. Broad enterprise urgency is lower than remotely exploitable kernel bugs, but downtime-sensitive systems should be handled promptly.

Technical view

CVE-2021-38204 is a use-after-free in drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6. Removing a MAX3421 USB device can trigger a kernel panic, causing denial of service. The source bundle provides no CVSS score, CWE mapping, or detailed affected distribution matrix.

Likely exposure

Systems are most likely exposed if they run a Linux kernel before 5.13.6 and use the MAX3421 USB host controller driver or connected MAX3421 hardware. General Linux fleets without this hardware or driver path appear less exposed, but should still confirm kernel package status through vendor advisories.

Exploitation context

The CVE description requires physical proximity and device removal. The source bundle does not show remote exploitation, privilege escalation, data compromise, public exploit activity, or CISA KEV listing. Treat this as a physical-access denial-of-service risk unless new vendor evidence says otherwise.

Researcher notes

Key evidence is the CVE text, upstream Linux commit, Linux 5.13.6 changelog, and Debian LTS advisory. The bundle lacks CVSS, CWE, exploit status, and a full affected-version matrix, so validation should focus on driver exposure and vendor-patched kernel lineage.

Mitigation direction

  • Upgrade to Linux kernel 5.13.6 or a vendor backport containing the fix.
  • Apply the Debian LTS linux security update where Debian LTS systems are affected.
  • Restrict physical access to systems using MAX3421 USB hardware until patched.
  • Check OS vendor advisories for supported package versions and reboot requirements.

Validation and detection

  • Inventory systems running kernels before 5.13.6 with MAX3421 hardware or max3421-hcd usage.
  • Confirm installed kernel packages include the referenced upstream fix or vendor backport.
  • Verify systems have rebooted into the patched kernel after updates.
  • Review incident records for unexplained panics tied to USB device removal.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-38204 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.