CVE-2021-4032

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-21 · updated 2026-06-17
Weakness: CWE-459

Description

A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected. In this flaw the KVM subsystem may crash the kernel due to mishandling of memory errors that happens during VCPU construction, which allows an attacker with special user privilege to cause a denial of service. This flaw affects kernel versions prior to 5.15 rc7.

Affected products

Linux kernel: through 5.14; 5.15, 5.15-rc1, 5.15-rc2, 5.15-rc3, 5.15-rc4, 5.15-rc5 (+1)

References

https://bugzilla.redhat.com/show_bug.cgi?id=2027403
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f7d8a19f9a056a05c5c509fa65af472a322abfee
https://lkml.org/lkml/2021/9/8/587
https://bugzilla.redhat.com/show_bug.cgi?id=2027403
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f7d8a19f9a056a05c5c509fa65af472a322abfee
https://lkml.org/lkml/2021/9/8/587

Get alerted when CVE-2021-4032 or the next vulnerability affects your stack