What’s Vulnerable › Vulnerabilities

CVE-2021-3923

• Severity: low (CVSS 2.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-27 · updated 2026-06-17
• Weakness: CWE-200

Description

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.

Affected products

• Fedoraproject Fedora: 37
• Linux kernel: before 5.15.14 — fixed in 5.15.14
• Red Hat Enterprise Linux: 6.0, 7.0, 8.0

How to fix

Upgrade to a fixed version: Linux kernel 5.15.14. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2019643
• https://lore.kernel.org/all/20220204100036.GA12348%40kili/
• https://bugzilla.redhat.com/show_bug.cgi?id=2019643
• https://lore.kernel.org/all/20220204100036.GA12348%40kili/

Get alerted when CVE-2021-3923 or the next vulnerability affects your stack