What’s Vulnerable › Vulnerabilities

CVE-2021-31829

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-06 · updated 2026-06-17
• Weakness: CWE-863

Description

kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized data that might represent sensitive information previously operated on by the kernel.

Affected products

• Debian Linux: 9.0
• Fedoraproject Fedora: 32, 33, 34
• Linux kernel: through 5.12.1

References

• http://www.openwall.com/lists/oss-security/2021/05/04/4
• http://www.openwall.com/lists/oss-security/2021/05/04/4
• http://www.openwall.com/lists/oss-security/2021/05/04/4
• http://www.openwall.com/lists/oss-security/2021/05/04/4
• https://github.com/torvalds/linux/commit/801c6058d14a82179a7ee17a4b532cac6fad067f
• https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VWCZ6LJLENL2C3URW5ICARTACXPFCFN2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4X2G5YAPYJGI3PFEZZNOTRYI33GOCCZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZI7OBCJQDNWMKLBP6MZ5NV4EUTDAMX6Q/
• http://www.openwall.com/lists/oss-security/2021/05/04/4
• http://www.openwall.com/lists/oss-security/2021/05/04/4
• http://www.openwall.com/lists/oss-security/2021/05/04/4

Get alerted when CVE-2021-31829 or the next vulnerability affects your stack