CVE-2021-27364

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-07 · updated 2026-07-30
Weakness: CWE-125

Description

An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04
Debian Linux: 9.0
Linux kernel: before 4.4.260; from 4.5 before 4.9.260; from 4.10 before 4.14.224; from 4.15 before 4.19.179; from 4.20 before 5.4.103; from 5.5 before 5.10.21 — fixed in 4.14.224, 4.19.179, 4.4.260, 4.9.260, 5.10.21, 5.11.4
NetApp Cloud Backup: all versions
NetApp Solidfire Baseboard Management Controller Firmware: all versions
Oracle Tekelec Platform Distribution: from 7.4.0 through 7.7.1

How to fix

Upgrade to a fixed version: Linux kernel 4.14.224, 4.19.179, 4.4.260, 4.9.260. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-27364 or the next vulnerability affects your stack