CVE-2021-3501

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-06 · updated 2026-08-05
Weakness: CWE-787

Description

A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.

Affected products

Fedoraproject Fedora: 33
Linux kernel: before 5.12 — fixed in 5.12
NetApp Cloud Backup: all versions
NetApp H300E Firmware: all versions
NetApp H300S Firmware: all versions
NetApp H410C Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500E Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700E Firmware: all versions
NetApp H700S Firmware: all versions
NetApp Solidfire Baseboard Management Controller Firmware: all versions
Red Hat Enterprise Linux: 8.0
RedHat Enterprise Linux For Real Time: 8
RedHat Enterprise Linux For Real Time For Nfv: 8
RedHat Enterprise Linux For Real Time For Nfv Tus: 8.4
RedHat Enterprise Linux For Real Time Tus: 8.4
RedHat Virtualization: 4.0
RedHat Virtualization Host: 4.0

How to fix

Upgrade to a fixed version: Linux kernel 5.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3501 or the next vulnerability affects your stack