What’s Vulnerable › Vulnerabilities

CVE-2021-3659

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-22 · updated 2026-06-17
• Weakness: CWE-252

Description

A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.

Affected products

• Fedoraproject Fedora: 34
• Linux kernel: before 5.12 — fixed in 5.12
• RedHat Codeready Linux Builder: all versions
• Red Hat Enterprise Linux: 7.0, 8.0
• RedHat Enterprise Linux For Ibm Z Systems: 8.0
• RedHat Enterprise Linux For Ibm Z Systems Eus: 8.6
• RedHat Enterprise Linux For Power Little Endian Eus: 8.6
• RedHat Enterprise Linux For Real Time: 8.0
• RedHat Enterprise Linux For Real Time For Nfv: 8.0
• RedHat Enterprise Linux For Real Time For Nfv Tus: 8.6
• RedHat Enterprise Linux For Real Time Tus: 8.6
• RedHat Enterprise Linux Server Aus: 8.6
• RedHat Enterprise Linux Server Eus: 8.6
• RedHat Enterprise Linux Server Tus: 8.6
• RedHat Virtualization Host: 4.0

How to fix

Upgrade to a fixed version: Linux kernel 5.12. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2021-3659
• https://bugzilla.redhat.com/show_bug.cgi?id=1975949
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1165affd484889d4986cf3b724318935a0b120d8
• https://access.redhat.com/security/cve/CVE-2021-3659
• https://bugzilla.redhat.com/show_bug.cgi?id=1975949
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1165affd484889d4986cf3b724318935a0b120d8

Get alerted when CVE-2021-3659 or the next vulnerability affects your stack