What’s Vulnerable › Vulnerabilities

CVE-2021-23134: Linux kernel llcp_sock_bind/connect use-after-free

• Severity: medium (CVSS 4.6 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-12 · updated 2026-07-30
• Weakness: CWE-416

Description

Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.

Affected products

• Debian Linux: 9.0
• Fedoraproject Fedora: 33, 34
• Linux kernel: before 4.4.269; from 4.5 before 4.9.269; from 4.10 before 4.14.233; from 4.15 before 4.19.191; from 4.20 before 5.4.119; from 5.5 before 5.10.37 — fixed in 4.14.233, 4.19.191, 4.4.269, 4.9.269, 5.10.37, 5.11.21
• NetApp Cloud Backup: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Solidfire Baseboard Management Controller Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.233, 4.19.191, 4.4.269, 4.9.269. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=c61760e6940d
• https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
• https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZYORWNQIHNWRFYRDXBWYWBYM46PDZEN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QALNQT4LJFVSSA3MWCIECVY4AFPP4X77/
• https://security.netapp.com/advisory/ntap-20210625-0007/
• https://www.openwall.com/lists/oss-security/2021/05/11/4
• https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=c61760e6940d
• https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
• https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZYORWNQIHNWRFYRDXBWYWBYM46PDZEN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QALNQT4LJFVSSA3MWCIECVY4AFPP4X77/

Get alerted when CVE-2021-23134 or the next vulnerability affects your stack