CVE-2021-4135

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-14 · updated 2026-10-08
Weakness: CWE-200

Description

A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.

Affected products

Linux kernel: before 5.16; 5.16, 5.16-rc1, 5.16-rc2, 5.16-rc3, 5.16-rc4, 5.16-rc5 — fixed in 5.16

How to fix

Upgrade to a fixed version: Linux kernel 5.16. Check the vendor advisory for mitigations.

References

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53

Get alerted when CVE-2021-4135 or the next vulnerability affects your stack