CVE-2021-4002

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-03 · updated 2026-06-17
Weakness: CWE-459

Description

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data.

Affected products

Debian Linux: 9.0, 10.0
Fedoraproject Fedora: 35
Linux kernel: before 5.16; 5.16, 5.16-rc1, 5.16-rc2 — fixed in 5.16
Oracle Communications Cloud Native Core Binding Support Function: 22.1.3
Oracle Communications Cloud Native Core Network Exposure Function: 22.1.1
Oracle Communications Cloud Native Core Policy: 22.2.0

How to fix

Upgrade to a fixed version: Linux kernel 5.16. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-4002 or the next vulnerability affects your stack