CVE-2021-31440

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-21 · updated 2026-06-17
Weakness: CWE-682

Description

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-13661.

Affected products

Linux kernel: from 5.7 before 5.10.37; from 5.11 before 5.11.21; from 5.12 before 5.12.4 — fixed in 5.10.37, 5.11.21, 5.12.4
NetApp Cloud Backup: all versions
NetApp H300E Firmware: all versions
NetApp H300S Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500E Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700E Firmware: all versions
NetApp H700S Firmware: all versions
NetApp Solidfire Baseboard Management Controller Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 5.10.37, 5.11.21, 5.12.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-31440 or the next vulnerability affects your stack