What’s Vulnerable › Vulnerabilities

CVE-2021-38209

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-08 · updated 2026-06-17
• Weakness: CWE-203

Description

net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls.

Affected products

• Linux kernel: before 5.12.2 — fixed in 5.12.2

How to fix

Upgrade to a fixed version: Linux kernel 5.12.2. Check the vendor advisory for mitigations.

References

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.2
• https://github.com/torvalds/linux/commit/2671fa4dc0109d3fb581bc3078fdf17b5d9080f6
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.2
• https://github.com/torvalds/linux/commit/2671fa4dc0109d3fb581bc3078fdf17b5d9080f6

Get alerted when CVE-2021-38209 or the next vulnerability affects your stack