CVE-2021-20226

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-23 · updated 2026-06-17
Weakness: CWE-416

Description

A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.

Affected products

Linux kernel: from 5.5 before 5.8.18; from 5.9.0 before 5.9.3 — fixed in 5.8.18, 5.9.3
NetApp Cloud Backup: all versions

How to fix

Upgrade to a fixed version: Linux kernel 5.8.18, 5.9.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-20226 or the next vulnerability affects your stack