CVE-2021-3501
At a glance Severity Not available EPSS EPSS 0.38 % · percentile 32 (2026-10-27) State PUBLISHED Published 2021-05-05 Updated 2026-08-05 Assigner redhat NVD status Modified Description A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 2.0 LOW 3.6 AV:L/AC:L/Au:N/C:N/I:P/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* < 5.12cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_real_time:8:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.4:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*Affected products Product Versions Linux · kernel affected 5.9 < 5.10.32 ; affected 5.11 < 5.11.16
References
Sources
