All vulnerabilities
CVE-2021-22555GHSA-xxx5-8mvq-3528

Linux Kernel Heap Out-of-Bounds Write Vulnerability

Linux KernelOperating systems
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationExploited in the wildAdded to KEV 6 Oct 2025CISA KEV
Exploit odds (EPSS)78.7%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.12 (b29c457a6511435960115c0f548c4360d5f4801d)Also 5.10.31, 5.4.113 and 4 moreGitHub
Federal deadline27 Oct 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 5.12 (b29c457a6511435960115c0f548c4360d5f4801d)Linux KernelGitHub
  • 5.10.31Linux KernelGitHub
  • 5.4.113Linux KernelGitHub
  • 4.19.188Linux KernelGitHub
  • 4.14.231Linux KernelGitHub
  • 4.9.267Linux KernelGitHub
Show all 7 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 7 Jul 2021, 11:20 UTCPublishedCVE List
  2. 7 Jul 2021Exploit code publicMetasploit
  3. 6 Oct 2025Added to CISA KEVCISA KEV

Public exploit code and templates 2

  • Exploit moduleNetfilter x_tables Heap OOB Write Privilege Escalation 7 Jul 2021Metasploit
  • Local exploitLinux Kernel 2.6.19 < 5.9 - 'Netfilter Local Privilege Escalation 15 Jul 2021Exploit-DB

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.

Text from CVE List

Affected versions 2

  • Linux Kernelaffected: 2.6.19-rc1 before unspecifiedCVE List
  • Linux Kernel>=2.6.19 (9fa492cdc160cd27ce1046cb36f47d3b2b1efa21)GitHub

References 6