What’s Vulnerable › Vulnerabilities

CVE-2021-4001

• Severity: medium (CVSS 4.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-21 · updated 2026-10-08
• Weakness: CWE-367

Description

A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.

Affected products

• Linux kernel: through 5.15; 5.16-rc1

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2025645
• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
• https://bugzilla.redhat.com/show_bug.cgi?id=2025645
• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53

Get alerted when CVE-2021-4001 or the next vulnerability affects your stack