CVE-2021-3490

highpriority · attend · 51EPSS 0.274 · 98 %ileexploit · weaponizedEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

6 exploits · weaponized

Likely / severe?

27.4% (98th) EPSS

CVSS 7.2 · high

Is it mine?

27 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 3.9 · impact 10

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · security@ubuntu.comexploitability 1.1 · impact 6

v3.17.6highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Fsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-125USprimaryCWE-787USprimaryCWE-125USCWE-20USCWE-20USCWE-787US

exploits (6)

Public proof-of-concept and weaponised exploit code.

exploit/linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpeLinux eBPF ALU32 32-bit Invalid Bounds Tracking LPEweaponized · metasploit
WhatsWrongAndWhy/CVE-2021-3490WhatsWrongAndWhy/CVE-2021-3490PoC · poc_in_github
chompie1337/Linux_LPE_eBPF_CVE-2021-3490chompie1337/Linux_LPE_eBPF_CVE-2021-3490PoC · poc_in_github
pivik271/CVE-2021-3490pivik271/CVE-2021-3490PoC · poc_in_github
prabeershakya/CVE-2021-3490-POCprabeershakya/CVE-2021-3490-POCPoC · poc_in_github
sandesh9978/cve-2021-3490-ebpf-analysisResearch implementation demonstrating interaction with Linux eBPF subsystem related to CVE-2021-3490. Includes BPF map creation, syscall wrappers, namespace setup, and verifier analysis. For educational and security research purposes only.PoC · poc_in_github

affected products (27)

Products and version ranges known to be affected.

Linux Linux kernellinux-5.10.y → v5.10.37enisa_euvdEU
Linux Linux kernellinux-5.11.y → v5.11.21enisa_euvdEU
Linux Linux kernellinux-5.12.y → v5.12.4enisa_euvdEU
Linux Linux kerneltrunk → v5.13-rc4enisa_euvdEU
Linux Linux kernelv5.7-rc1 → 5.7*enisa_euvdEU
Canonical Ltd. Ubuntu≤ 20.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 20.10fstec_bduRU
Canonical Ltd. Ubuntu≤ 21.04fstec_bduRU
Fedora Project Fedora≤ 34fstec_bduRU
Fedora Project Fedora≤ 33fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.3fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.4fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 9fstec_bduRU
Сообщество свободного программного обеспечения Linux5.11.0 → 5.11.20fstec_bduRU
Сообщество свободного программного обеспечения Linux5.12.0 → 5.12.3fstec_bduRU
Сообщество свободного программного обеспечения Linux5.7 → 5.10.36fstec_bduRU

showing 20 of 27

advisories (1)

Vendor and ecosystem advisories describing this.

PUB-A-1908766662021-10-01vendor · osvUS
In scalar32_min_max_and and related functions of verifier.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv NVD CVE.org MITRE

published 2021-06-04modified 2026-06-17

related (27,245)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-86950US	—OT critical	26.2% (98th)	KEV	2026-09-28
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1,…
CVE-2026-87491US	—OT critical	3.51% (89th)	KEV	2026-09-09
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security…
CVE-2026-53362US	—OT critical	0.71% (53rd)	KEV	2026-07-04
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branc…
CVE-2026-53266US	—OT critical	0.93% (61st)	KEV	2026-06-25
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source addre…
CVE-2026-11645US	—OT critical	2.44% (84th)	KEV	2026-06-09
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium…

+27240 more

references (32)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan