Every CVE Search/ Get API key

CVE-2021-35039

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID...

7.8 HighFix available

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.25%Down 0.8 points since Jul 7, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

Record
CVE-2021-35039
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-347
Updated
2026-11-02
CVE List No score

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

Record
CVE-2021-35039
Updated
2026-11-02
EUVDEUVD-2021-21686 No score

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

Record
EUVD-2021-21686
Updated
2026-11-03
GitHub AdvisoriesGHSA-jf73-g393-6jw9 7.8

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID...

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

Record
GHSA-jf73-g393-6jw9
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-347
Updated
2026-11-02
OSVAZL-6570 7.8

CVE-2021-35039 affecting package kernel for versions less than 5.10.78.1-1

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

Record
AZL-6570
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

Record
CVE-2021-35039
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 15 moreShow less
OSVDEBIAN-CVE-2021-35039 7.8

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

Record
DEBIAN-CVE-2021-35039
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2021-1279 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

there was a null pointer dereference in llcp_sock_getname in net/nfc/llcp_sock.c and reproduced it in linux-5.13.0-rc2. An unprivileged user can trigger this bug and cause denial of service. #Root Cause After creating an nfc socket, bind the address by calling bind(), if LLCP_SAP_MAX was used as SAP, it cause the bind() failed and there would set llcp_sock->service_name as NULL. Although bind() returns an error here, it does not affect calling other socket functions. sock_getname() would invoke llcp_sock_getname(), llcp_sock_getname copied service name from llcp_sock->service_name by memcpy but llcp_sock->service_name is NULL. #Fix the patch for this issue: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=4ac06a1e013c(CVE-2021-3587)

An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.(CVE-2020-36385)

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.(CVE-2020-28097)

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.(CVE-2021-33624)

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.(CVE-2021-35039)

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space(CVE-2021-22555)

A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user detaches bluetooth dongle or other way triggers unregister bluetooth device event. A local user could use this flaw to crash the system or escalate their privileges on the system.(CVE-2021-3573)

Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.(CVE-2021-0129)

net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.(CVE-2021-34693)

An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35.(CVE-2020-36387)

A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges.(CVE-2021-3609)

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.(CVE-2021-3600)

Record
OESA-2021-1279
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-35039 7.8

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

Record
UBUNTU-CVE-2021-35039
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-06
OSVCLSA-2026-1780132980 No score

kernel: Fix of 46 CVEs

  • tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
  • scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
  • e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
  • module: limit enabling module.sig_enforce {CVE-2021-35039}
  • Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
  • HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
  • libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
  • scsi: qla2xxx: Fix improper freeing of purex item {CVE-2025-68741}
  • binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
  • ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
  • kernfs: fix use-after-free in __kernfs_remove {CVE-2022-50432}
  • rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
  • virtio_console: Assure used length from device is limited {CVE-2021-38160}
  • Squashfs: check metadata block offset is within range {CVE-2026-23388}
  • Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
  • wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
  • cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
  • ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
  • selinux: Add boundary check in put_entry() {CVE-2022-50200}
  • nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
  • ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
  • drm/i915/perf: add sentinel to xehp_oa_b_counters {CVE-2023-53646}
  • net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
  • wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() {CVE-2023-53570}
  • vt: Clear selection before changing the font {CVE-2022-49948}
  • ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
  • netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
  • net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
  • capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
  • powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
  • lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
  • ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
  • udf: Do not bother merging very long extents {CVE-2023-53506}
  • gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
  • wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
  • thermal: core: prevent potential string overflow {CVE-2023-52868}
  • drm/radeon: possible buffer overflow {CVE-2023-52867}
  • ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
  • net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
  • Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
  • drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
  • ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
  • netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
  • smb: client: reject userspace cifs.spnego descriptions
  • ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
Record
CLSA-2026-1780132980
Updated
2026-11-02
OSVMGASA-2021-0347 No score

Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.10.48 and fixes at least the following security issues:

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541).

An issue was discovered in Linux: KVM through Improper handling of VM_IO| VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (CVE-2021-22543).

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument (CVE-2021-35039).

Other fixes in this update:

  • ahci: Add support for Dell S140 and later controllers
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445/450/630 G8
  • drm/amdgpu: fix bad address translation for sienna_cichlid
  • drm/sched: Avoid data corruptions
  • net: ip: avoid OOM kills with large UDP sends over loopback
  • iwlwifi: Add support for ax201 in Samsung Galaxy Book Flex2 Alpha
  • virtio_net: Remove BUG() to avoid machine dead

For other upstream fixes, see the referenced changelogs.

Record
MGASA-2021-0347
Updated
2026-11-02
OSVMGASA-2021-0348 No score

Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.10.48 and fixes at least the following security issues:

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541).

An issue was discovered in Linux: KVM through Improper handling of VM_IO| VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (CVE-2021-22543).

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument (CVE-2021-35039).

For other upstream fixes, see the referenced changelogs.

Record
MGASA-2021-0348
Updated
2026-11-02
OSVopenSUSE-SU-2021:1076-1 No score

Security update for the Linux Kernel

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-22555: A heap out-of-bounds write affecting Linux was discovered in net/netfilter/x_tables.c (bnc#1188116).
  • CVE-2021-33909: fs/seq_file.c did not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05 (bnc#1188062).
  • CVE-2021-3609: A use-after-free in can/bcm could have led to privilege escalation (bsc#1187215).
  • CVE-2021-3612: An out-of-bounds memory write flaw was found in the joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability (bnc#1187585 ).
  • CVE-2021-35039: kernel/module.c in the Linux kernel mishandled Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bnc#1188080).

The following non-security bugs were fixed:

  • ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
  • ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
  • ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
  • ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
  • ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
  • ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
  • ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
  • ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
  • ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
  • ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
  • ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
  • ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
  • ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
  • ALSA: usb-audio: scarlett2: Fix wrong resume call (git-fixes).
  • ALSA: usb-audio: scarlett2: Read mixer volumes at init time (git-fixes).
  • ALSA: usb-audio: scarlett2: Read mux at init time (git-fixes).
  • amdgpu: fix GEM obj leak in amdgpu_display_user_framebuffer_create (bsc#1152472)
  • ARM: ensure the signal page contains defined contents (bsc#1188445).
  • ASoC: atmel-i2s: Fix usage of capture and playback at the same time (git-fixes).
  • ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes).
  • ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes).
  • ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()' (git-fixes).
  • ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() (git-fixes).
  • ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
  • ata: ahci_sunxi: Disable DIPM (git-fixes).
  • ath10k: add missing error return code in ath10k_pci_probe() (git-fixes).
  • ath10k: Fix an error code in ath10k_add_interface() (git-fixes).
  • ath10k: go to path err_unsupported when chip id is not supported (git-fixes).
  • ath10k: remove unused more_frags variable (git-fixes).
  • ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() (git-fixes).
  • backlight: lm3630a_bl: Put fwnode in error case during ->probe() (git-fixes).
  • blk-mq: Add blk_mq_delay_run_hw_queues() API call (bsc#1180092).
  • blk-mq: In blk_mq_dispatch_rq_list() 'no budget' is a reason to kick (bsc#1180092).
  • blk-mq: insert flush request to the front of dispatch queue (bsc#1180092).
  • blk-mq: insert passthrough request into hctx->dispatch directly (bsc#1180092).
  • blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget (bsc#1180092).
  • blk-mq: Rerun dispatching in the case…
Record
openSUSE-SU-2021:1076-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2645-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
  • CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
  • CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
  • CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
  • CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
  • CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
  • CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

  • ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
  • ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
  • ACPI: DPTF: Fix reading of attributes (git-fixes).
  • ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
  • ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
  • ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
  • ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
  • ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
  • ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
  • ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
  • ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
  • ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
  • ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
  • ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
  • ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
  • ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
  • ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
  • ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
  • ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
  • ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
  • ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
  • ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
  • ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
  • ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
  • ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
  • ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
  • ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
  • ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
  • ALSA: pcm: Fix mmap capability check (git-fixes).
  • ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).…
Record
openSUSE-SU-2021:2645-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2687-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
  • CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
  • CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
  • CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
  • CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
  • CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
  • CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

  • ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
  • ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
  • ACPI: DPTF: Fix reading of attributes (git-fixes).
  • ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
  • ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
  • ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
  • ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
  • ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
  • ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
  • ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
  • ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
  • ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
  • ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
  • ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
  • ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
  • ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
  • ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
  • ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
  • ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
  • ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
  • ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
  • ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
  • ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
  • ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
  • ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
  • ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
  • ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
  • ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
  • ALSA: pcm: Fix mmap capability check (git-fixes).
  • ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes). -…
Record
openSUSE-SU-2021:2687-1
Updated
2026-11-02
OSVSUSE-SU-2021:2408-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116).
  • CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges (bsc#1188062).
  • CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation (bsc#1187215).
  • CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
  • CVE-2021-35039: Fixed a bug where modules signature verification did not occur if CONFIG_MODULE_SIG is not set, regardless of the value of module.sig_enforce command-line argument. (bnc#1188080)

The following non-security bugs were fixed:

  • ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
  • ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
  • ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
  • ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
  • ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
  • ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
  • ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
  • ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
  • ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
  • ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
  • ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
  • ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
  • ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
  • ALSA: usb-audio: scarlett2: Fix wrong resume call (git-fixes).
  • ALSA: usb-audio: scarlett2: Read mixer volumes at init time (git-fixes).
  • ALSA: usb-audio: scarlett2: Read mux at init time (git-fixes).
  • amdgpu: fix GEM obj leak in amdgpu_display_user_framebuffer_create (bsc#1152472)
  • ASoC: atmel-i2s: Fix usage of capture and playback at the same time (git-fixes).
  • ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes).
  • ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes).
  • ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()' (git-fixes).
  • ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() (git-fixes).
  • ata: ahci_sunxi: Disable DIPM (git-fixes).
  • ath10k: add missing error return code in ath10k_pci_probe() (git-fixes).
  • ath10k: Fix an error code in ath10k_add_interface() (git-fixes).
  • ath10k: go to path err_unsupported when chip id is not supported (git-fixes).
  • ath10k: remove unused more_frags variable (git-fixes).
  • ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() (git-fixes).
  • backlight: lm3630a_bl: Put fwnode in error case during ->probe() (git-fixes).
  • Blacklist already cherry-picked ASoC commits
  • Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event (git-fixes).
  • Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (git-fixes).
  • brcmfmac: correctly report average RSSI in station info (git-fixes).
  • brcmfmac: fix setting of station info chains bitmask (git-fixes).
  • brcmsmac: mac80211_if: Fix a resource leak in an error handling path (git-fixes).
  • can: gw: synchronize rcu operations before removing gw job entry (git-fixes).
  • can: hi311x: hi3110_can_probe(): silence clang warning (git-fixes).
  • can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path (git-fixes).
  • cfg80211: call cfg80211_leave_ocb when switching away from OCB (git-fixes).
  • char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol() (git-fixes).
  • clk: actions: Fix bisp_factor_table based clocks on Owl S500 SoC (git-fixes).
  • clk: actions: Fix SD…
Record
SUSE-SU-2021:2408-1
Updated
2026-11-02
OSVSUSE-SU-2021:2438-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116).
  • CVE-2021-33909: Extremely large seq buffer allocations in seq_file could lead to buffer underruns and code execution (bsc#1188062).
  • CVE-2021-3609: A use-after-free in can/bcm could have led to privilege escalation (bsc#1187215).
  • CVE-2021-3612: An out-of-bounds memory write flaw was found in the joystick devices subsystem in the way the user calls ioctl JSIOCSBTNMAP. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability (bnc#1187585 ).
  • CVE-2021-35039: kernel/module.c mishandled Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bnc#1188080). NOTE that SUSE kernels are configured with CONFIG_MODULE_SIG=y, so are not affected.

The following non-security bugs were fixed:

  • ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
  • ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
  • ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
  • ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
  • ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
  • ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
  • ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
  • ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
  • ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
  • ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
  • ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
  • ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
  • ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
  • ALSA: usb-audio: scarlett2: Fix wrong resume call (git-fixes).
  • ALSA: usb-audio: scarlett2: Read mixer volumes at init time (git-fixes).
  • ALSA: usb-audio: scarlett2: Read mux at init time (git-fixes).
  • amdgpu: fix GEM obj leak in amdgpu_display_user_framebuffer_create (bsc#1152472)
  • ASoC: atmel-i2s: Fix usage of capture and playback at the same time (git-fixes).
  • ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes).
  • ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes).
  • ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()' (git-fixes).
  • ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() (git-fixes).
  • ata: ahci_sunxi: Disable DIPM (git-fixes).
  • ath10k: add missing error return code in ath10k_pci_probe() (git-fixes).
  • ath10k: Fix an error code in ath10k_add_interface() (git-fixes).
  • ath10k: go to path err_unsupported when chip id is not supported (git-fixes).
  • ath10k: remove unused more_frags variable (git-fixes).
  • ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() (git-fixes).
  • backlight: lm3630a_bl: Put fwnode in error case during ->probe() (git-fixes).
  • Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event (git-fixes).
  • Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (git-fixes).
  • brcmfmac: correctly report average RSSI in station info (git-fixes).
  • brcmfmac: fix setting of station info chains bitmask (git-fixes).
  • brcmsmac: mac80211_if: Fix a resource leak in an error handling path (git-fixes).
  • can: gw: synchronize rcu operations before removing gw job entry (git-fixes).
  • can: hi311x: hi3110_can_probe(): silence clang warning (git-fixes).
  • can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path (git-fixes). -…
Record
SUSE-SU-2021:2438-1
Updated
2026-11-02
OSVSUSE-SU-2021:2599-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
  • CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
  • CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
  • CVE-2021-35039: Fixed a bug where modules signature verification did not occur if CONFIG_MODULE_SIG is not set, regardless of the value of module.sig_enforce command-line argument. (bnc#1188080)

The following non-security bugs were fixed:

  • ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
  • ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
  • ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
  • ACPI: Fix memory leak caused by _CID repair function (git-fixes).
  • ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
  • ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
  • ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
  • ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
  • ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
  • ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
  • ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
  • ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
  • ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
  • ALSA: usb-audio: scarlett2: Fix wrong resume call (git-fixes).
  • ALSA: usb-audio: scarlett2: Read mixer volumes at init time (git-fixes).
  • ALSA: usb-audio: scarlett2: Read mux at init time (git-fixes).
  • amdgpu: fix GEM obj leak in amdgpu_display_user_framebuffer_create (bsc#1152472) Backporting changes: * context changes
  • ASoC: atmel-i2s: Fix usage of capture and playback at the same time (git-fixes).
  • ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes).
  • ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes).
  • ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()' (git-fixes).
  • ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() (git-fixes).
  • ata: ahci_sunxi: Disable DIPM (git-fixes).
  • ath10k: add missing error return code in ath10k_pci_probe() (git-fixes).
  • ath10k: Fix an error code in ath10k_add_interface() (git-fixes).
  • ath10k: go to path err_unsupported when chip id is not supported (git-fixes).
  • ath10k: remove unused more_frags variable (git-fixes).
  • ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() (git-fixes).
  • backlight: lm3630a_bl: Put fwnode in error case during ->probe() (git-fixes).
  • blk-mq: Add blk_mq_delay_run_hw_queues() API call (bsc#1180092).
  • blk-mq: In blk_mq_dispatch_rq_list() 'no budget' is a reason to kick (bsc#1180092).
  • blk-mq: insert flush request to the front of dispatch queue (bsc#1180092).
  • blk-mq: insert passthrough request into hctx->dispatch directly (bsc#1180092).
  • blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget (bsc#1180092).
  • blk-mq: Rerun dispatching in the case of budget contention (bsc#1180092).
  • Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event (git-fixes).
  • Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (git-fixes).
  • bpftool: Properly close va_list 'ap' by va_end() on error (bsc#1155518).
  • brcmfmac: correctly report average RSSI in station info (git-fixes).
  • brcmfmac: fix setting of station info chains bitmask (git-fixes).
  • brcmsmac: mac80211_if: Fix a resource leak in an error handling path (git-fixes).
  • can: gw: synchronize rcu operations before removing gw job entry (git-fixes).
  • can:…
Record
SUSE-SU-2021:2599-1
Updated
2026-11-02
OSVSUSE-SU-2021:2599-2 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
  • CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
  • CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
  • CVE-2021-35039: Fixed a bug where modules signature verification did not occur if CONFIG_MODULE_SIG is not set, regardless of the value of module.sig_enforce command-line argument. (bnc#1188080)

The following non-security bugs were fixed:

  • ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
  • ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
  • ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
  • ACPI: Fix memory leak caused by _CID repair function (git-fixes).
  • ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
  • ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
  • ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
  • ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
  • ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
  • ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
  • ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
  • ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
  • ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
  • ALSA: usb-audio: scarlett2: Fix wrong resume call (git-fixes).
  • ALSA: usb-audio: scarlett2: Read mixer volumes at init time (git-fixes).
  • ALSA: usb-audio: scarlett2: Read mux at init time (git-fixes).
  • amdgpu: fix GEM obj leak in amdgpu_display_user_framebuffer_create (bsc#1152472) Backporting changes: * context changes
  • ASoC: atmel-i2s: Fix usage of capture and playback at the same time (git-fixes).
  • ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes).
  • ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes).
  • ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()' (git-fixes).
  • ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() (git-fixes).
  • ata: ahci_sunxi: Disable DIPM (git-fixes).
  • ath10k: add missing error return code in ath10k_pci_probe() (git-fixes).
  • ath10k: Fix an error code in ath10k_add_interface() (git-fixes).
  • ath10k: go to path err_unsupported when chip id is not supported (git-fixes).
  • ath10k: remove unused more_frags variable (git-fixes).
  • ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() (git-fixes).
  • backlight: lm3630a_bl: Put fwnode in error case during ->probe() (git-fixes).
  • blk-mq: Add blk_mq_delay_run_hw_queues() API call (bsc#1180092).
  • blk-mq: In blk_mq_dispatch_rq_list() 'no budget' is a reason to kick (bsc#1180092).
  • blk-mq: insert flush request to the front of dispatch queue (bsc#1180092).
  • blk-mq: insert passthrough request into hctx->dispatch directly (bsc#1180092).
  • blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget (bsc#1180092).
  • blk-mq: Rerun dispatching in the case of budget contention (bsc#1180092).
  • Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event (git-fixes).
  • Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (git-fixes).
  • bpftool: Properly close va_list 'ap' by va_end() on error (bsc#1155518).
  • brcmfmac: correctly report average RSSI in station info (git-fixes).
  • brcmfmac: fix setting of station info chains bitmask (git-fixes).
  • brcmsmac: mac80211_if: Fix a resource leak in an error handling path (git-fixes).
  • can: gw: synchronize rcu operations before removing gw job entry (git-fixes).
  • can:…
Record
SUSE-SU-2021:2599-2
Updated
2026-11-02
OSVSUSE-SU-2021:2645-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
  • CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
  • CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
  • CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
  • CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
  • CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
  • CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

  • ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
  • ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
  • ACPI: DPTF: Fix reading of attributes (git-fixes).
  • ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
  • ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
  • ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
  • ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
  • ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
  • ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
  • ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
  • ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
  • ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
  • ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
  • ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
  • ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
  • ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
  • ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
  • ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
  • ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
  • ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
  • ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
  • ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
  • ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
  • ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
  • ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
  • ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
  • ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
  • ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
  • ALSA: pcm: Fix mmap capability check (git-fixes).
  • ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).…
Record
SUSE-SU-2021:2645-1
Updated
2026-11-02
OSVSUSE-SU-2021:2687-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
  • CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
  • CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
  • CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
  • CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
  • CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
  • CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

  • ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
  • ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
  • ACPI: DPTF: Fix reading of attributes (git-fixes).
  • ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
  • ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
  • ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
  • ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
  • ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
  • ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
  • ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
  • ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
  • ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
  • ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
  • ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
  • ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
  • ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
  • ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
  • ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
  • ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
  • ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
  • ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
  • ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
  • ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
  • ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
  • ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
  • ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
  • ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
  • ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
  • ALSA: pcm: Fix mmap capability check (git-fixes).
  • ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes). -…
Record
SUSE-SU-2021:2687-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kernel
Azure Linux:2
 before 5.10.78.1-1
5.10.78.1-1
bpftool
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-core
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-cross-headers
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-debug
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-debug-core
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-debug-devel
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-debug-modules
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-debug-modules-extra
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
Show 117 moreShow less
Affected packages
PackageAffectedFixed
kernel-debug-modules-internal
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-devel
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-headers
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-ipaclones-internal
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-modules
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-modules-extra
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-modules-internal
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-selftests-internal
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-tools
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-tools-libs
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
kernel-tools-libs-devel
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
perf
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
python3-perf
TuxCare:CentOS-Stream:8
From an advisory covering 45 CVEs
 before 4.18.0-553.6.1.el8_10.tuxcare.els22
4.18.0-553.6.1.el8_10.tuxcare.els22
linux
Debian:12
 before 5.14.6-1
5.14.6-1
linux
Debian:13
 before 5.14.6-1
5.14.6-1
linux
Debian:14
 before 5.14.6-1
5.14.6-1
linux-4.19
Debian:9
From an advisory covering 27 CVEs
 before 4.19.208-1~deb9u1, plus listed versions
4.19.132-1~deb9u14.19.132-1~deb9u24.19.146-1~deb9u14.19.152-1~deb9u14.19.160-2~deb9u1
Show 4 moreShow less
4.19.171-2~deb9u14.19.181-1~deb9u14.19.194-1~deb9u14.19.194-3~deb9u1
4.19.208-1~deb9u1
kernel
Mageia:8
From an advisory covering 3 CVEs
 before 5.10.48-1.mga8
5.10.48-1.mga8
kmod-virtualbox
Mageia:8
From an advisory covering 3 CVEs
 before 6.1.22-1.10.mga8
6.1.22-1.10.mga8
kmod-xtables-addons
Mageia:8
From an advisory covering 3 CVEs
 before 3.18-1.10.mga8
3.18-1.10.mga8
kernel-linus
Mageia:8
From an advisory covering 3 CVEs
 before 5.10.48-1.mga8
5.10.48-1.mga8
kernel
openEuler:20.03-LTS-SP1
From an advisory covering 12 CVEs
 before 4.19.90-2107.4.0.0097.oe1
4.19.90-2107.4.0.0097.oe1
kernel
openEuler:20.03-LTS-SP2
From an advisory covering 12 CVEs
 before 4.19.90-2107.4.0.0097.oe1
4.19.90-2107.4.0.0097.oe1
kernel-azure
SUSE:Linux Enterprise Module for Public Cloud 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-18.58.1
5.3.18-18.58.1
kernel-source-azure
SUSE:Linux Enterprise Module for Public Cloud 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-18.58.1
5.3.18-18.58.1
kernel-syms-azure
SUSE:Linux Enterprise Module for Public Cloud 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-18.58.1
5.3.18-18.58.1
kernel-default
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3
5.3.18-24.75.3
kernel-default-base
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3.9.34.3
5.3.18-24.75.3.9.34.3
kernel-preempt
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3
5.3.18-24.75.3
kernel-source
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.2
5.3.18-24.75.2
kernel-docs
SUSE:Linux Enterprise Module for Development Tools 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.2
5.3.18-24.75.2
kernel-obs-build
SUSE:Linux Enterprise Module for Development Tools 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3
5.3.18-24.75.3
kernel-preempt
SUSE:Linux Enterprise Module for Development Tools 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3
5.3.18-24.75.3
kernel-source
SUSE:Linux Enterprise Module for Development Tools 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.2
5.3.18-24.75.2
kernel-syms
SUSE:Linux Enterprise Module for Development Tools 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.1
5.3.18-24.75.1
kernel-default
SUSE:Linux Enterprise Module for Legacy 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3
5.3.18-24.75.3
kernel-default
SUSE:Linux Enterprise Live Patching 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3
5.3.18-24.75.3
kernel-livepatch-SLE15-SP2_Update_17
SUSE:Linux Enterprise Live Patching 15 SP2
From an advisory covering 5 CVEs
 before 1-5.3.3
1-5.3.3
kernel-default
SUSE:Linux Enterprise High Availability Extension 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3
5.3.18-24.75.3
kernel-default
SUSE:Linux Enterprise Workstation Extension 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3
5.3.18-24.75.3
kernel-preempt
SUSE:Linux Enterprise Workstation Extension 15 SP2
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3
5.3.18-24.75.3
kernel-default
SUSE:Linux Enterprise Micro 5.0
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3
5.3.18-24.75.3
kernel-default-base
SUSE:Linux Enterprise Micro 5.0
From an advisory covering 5 CVEs
 before 5.3.18-24.75.3.9.34.3
5.3.18-24.75.3.9.34.3
kernel-rt
SUSE:Real Time Module 15 SP2
From an advisory covering 4 CVEs
 before 5.3.18-45.3
5.3.18-45.3
kernel-rt_debug
SUSE:Real Time Module 15 SP2
From an advisory covering 4 CVEs
 before 5.3.18-45.3
5.3.18-45.3
kernel-source-rt
SUSE:Real Time Module 15 SP2
From an advisory covering 4 CVEs
 before 5.3.18-45.3
5.3.18-45.3
kernel-syms-rt
SUSE:Real Time Module 15 SP2
From an advisory covering 4 CVEs
 before 5.3.18-45.2
5.3.18-45.2
kernel-rt
SUSE:Linux Enterprise Micro 5.0
From an advisory covering 4 CVEs
 before 5.3.18-45.3
5.3.18-45.3
kernel-azure
SUSE:Linux Enterprise Module for Public Cloud 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-38.17.1
5.3.18-38.17.1
kernel-source-azure
SUSE:Linux Enterprise Module for Public Cloud 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-38.17.1
5.3.18-38.17.1
kernel-syms-azure
SUSE:Linux Enterprise Module for Public Cloud 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-38.17.1
5.3.18-38.17.1
kernel-64kb
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-default
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-default-base
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1.18.10.1
5.3.18-59.19.1.18.10.1
kernel-preempt
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-source
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-zfcpdump
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-docs
SUSE:Linux Enterprise Module for Development Tools 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-obs-build
SUSE:Linux Enterprise Module for Development Tools 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-preempt
SUSE:Linux Enterprise Module for Development Tools 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-source
SUSE:Linux Enterprise Module for Development Tools 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-syms
SUSE:Linux Enterprise Module for Development Tools 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-default
SUSE:Linux Enterprise Module for Legacy 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-default
SUSE:Linux Enterprise Live Patching 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-livepatch-SLE15-SP3_Update_5
SUSE:Linux Enterprise Live Patching 15 SP3
From an advisory covering 7 CVEs
 before 1-7.3.1
1-7.3.1
kernel-default
SUSE:Linux Enterprise High Availability Extension 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-default
SUSE:Linux Enterprise Workstation Extension 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-preempt
SUSE:Linux Enterprise Workstation Extension 15 SP3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
linux-aws-fips
Ubuntu:Pro:FIPS-updates:18.04:LTS
 All versions, plus listed versions
4.15.0-2000.44.15.0-2018.184.15.0-2021.214.15.0-2022.224.15.0-2024.24
Show 45 moreShow less
4.15.0-2025.254.15.0-2026.264.15.0-2027.274.15.0-2030.314.15.0-2031.324.15.0-2033.344.15.0-2034.354.15.0-2035.374.15.0-2036.384.15.0-2037.394.15.0-2038.404.15.0-2039.414.15.0-2040.424.15.0-2041.434.15.0-2042.444.15.0-2044.464.15.0-2045.474.15.0-2048.504.15.0-2051.534.15.0-2052.544.15.0-2053.554.15.0-2054.564.15.0-2055.574.15.0-2056.584.15.0-2057.594.15.0-2059.614.15.0-2060.624.15.0-2061.634.15.0-2063.664.15.0-2064.674.15.0-2065.684.15.0-2066.694.15.0-2067.704.15.0-2069.724.15.0-2072.764.15.0-2075.804.15.0-2076.814.15.0-2078.834.15.0-2079.844.15.0-2080.854.15.0-2081.874.15.0-2082.884.15.0-2083.894.15.0-2085.914.15.0-2087.93
 None known
linux-azure-fips
Ubuntu:Pro:FIPS-updates:18.04:LTS
 All versions, plus listed versions
4.15.0-1002.24.15.0-2006.74.15.0-2007.84.15.0-2008.94.15.0-2009.10
Show 45 moreShow less
4.15.0-2012.144.15.0-2013.154.15.0-2015.174.15.0-2016.184.15.0-2017.204.15.0-2018.214.15.0-2020.234.15.0-2021.244.15.0-2022.254.15.0-2023.264.15.0-2024.274.15.0-2025.284.15.0-2026.294.15.0-2027.304.15.0-2030.334.15.0-2033.374.15.0-2034.384.15.0-2035.394.15.0-2036.404.15.0-2037.414.15.0-2038.424.15.0-2039.434.15.0-2041.454.15.0-2042.464.15.0-2043.474.15.0-2045.494.15.0-2046.504.15.0-2047.514.15.0-2048.524.15.0-2049.534.15.0-2050.544.15.0-2053.584.15.0-2056.624.15.0-2057.634.15.0-2059.654.15.0-2060.664.15.0-2062.684.15.0-2066.724.15.0-2067.734.15.0-2068.744.15.0-2070.764.15.0-2071.774.15.0-2072.784.15.0-2073.794.15.0-2074.80
 None known
linux-fips
Ubuntu:Pro:FIPS-updates:18.04:LTS
 All versions, plus listed versions
4.15.0-1027.324.15.0-1029.344.15.0-1034.394.15.0-1035.404.15.0-1037.42
Show 45 moreShow less
4.15.0-1038.434.15.0-1039.444.15.0-1040.454.15.0-1041.464.15.0-1044.504.15.0-1045.524.15.0-1046.534.15.0-1048.554.15.0-1049.564.15.0-1050.584.15.0-1051.594.15.0-1052.604.15.0-1053.614.15.0-1054.624.15.0-1055.634.15.0-1056.644.15.0-1057.654.15.0-1058.664.15.0-1059.674.15.0-1060.684.15.0-1063.714.15.0-1066.754.15.0-1067.764.15.0-1068.774.15.0-1069.784.15.0-1070.794.15.0-1071.804.15.0-1072.814.15.0-1073.824.15.0-1075.844.15.0-1076.854.15.0-1078.874.15.0-1080.894.15.0-1081.904.15.0-1083.924.15.0-1084.934.15.0-1085.944.15.0-1087.964.15.0-1090.1004.15.0-1093.1044.15.0-1094.1054.15.0-1096.1074.15.0-1097.1084.15.0-1098.1094.15.0-1099.110
 None known
linux-gcp-fips
Ubuntu:Pro:FIPS-updates:18.04:LTS
 All versions, plus listed versions
4.15.0-2013.144.15.0-2016.184.15.0-2017.194.15.0-2018.204.15.0-2019.21
Show 45 moreShow less
4.15.0-2020.224.15.0-2021.234.15.0-2022.244.15.0-2024.264.15.0-2025.274.15.0-2026.284.15.0-2028.314.15.0-2029.324.15.0-2030.334.15.0-2031.344.15.0-2032.354.15.0-2034.374.15.0-2037.414.15.0-2040.454.15.0-2041.464.15.0-2043.484.15.0-2044.494.15.0-2045.504.15.0-2047.524.15.0-2050.554.15.0-2052.574.15.0-2054.594.15.0-2055.604.15.0-2056.614.15.0-2057.624.15.0-2058.634.15.0-2059.644.15.0-2060.654.15.0-2061.664.15.0-2062.674.15.0-2063.684.15.0-2064.694.15.0-2065.704.15.0-2066.714.15.0-2067.724.15.0-2068.734.15.0-2069.744.15.0-2070.754.15.0-2071.764.15.0-2072.774.15.0-2073.784.15.0-2074.794.15.0-2075.804.15.0-2076.814.15.0-2077.83
 None known
linux-aws-fips
Ubuntu:Pro:FIPS:18.04:LTS
 All versions, plus listed versions
4.15.0-2000.4
 None known
linux-azure-fips
Ubuntu:Pro:FIPS:18.04:LTS
 All versions, plus listed versions
4.15.0-1002.2
 None known
linux-fips
Ubuntu:Pro:FIPS:18.04:LTS
 All versions, plus listed versions
4.15.0-1011.12
 None known
linux-gcp-fips
Ubuntu:Pro:FIPS:18.04:LTS
 All versions, plus listed versions
4.15.0-1001.1
 None known
linux-aws-5.11
Ubuntu:20.04:LTS
 before 5.11.0-1017.18~20.04.1, plus listed versions
5.11.0-1009.9~20.04.25.11.0-1014.15~20.04.15.11.0-1016.17~20.04.1
5.11.0-1017.18~20.04.1
linux-azure-5.11
Ubuntu:20.04:LTS
 before 5.11.0-1015.16~20.04.1, plus listed versions
5.11.0-1007.7~20.04.25.11.0-1012.13~20.04.15.11.0-1013.14~20.04.1
5.11.0-1015.16~20.04.1
linux-gcp-5.11
Ubuntu:20.04:LTS
 before 5.11.0-1018.20~20.04.2, plus listed versions
5.11.0-1009.10~20.04.15.11.0-1014.16~20.04.15.11.0-1017.19~20.04.1
5.11.0-1018.20~20.04.2
linux-oracle-5.11
Ubuntu:20.04:LTS
 before 5.11.0-1017.18~20.04.1, plus listed versions
5.11.0-1008.8~20.04.15.11.0-1013.14~20.04.15.11.0-1016.17~20.04.1
5.11.0-1017.18~20.04.1
linux-aws-fips
Ubuntu:Pro:FIPS-updates:20.04:LTS
 before 5.4.0-1069.73+fips2, plus listed versions
5.4.0-1021.21+fips2
5.4.0-1069.73+fips2
linux-azure-fips
Ubuntu:Pro:FIPS-updates:20.04:LTS
 before 5.4.0-1073.76+fips1, plus listed versions
5.4.0-1022.22+fips1
5.4.0-1073.76+fips1
linux-fips
Ubuntu:Pro:FIPS-updates:20.04:LTS
 before 5.4.0-1033.38, plus listed versions
5.4.0-1026.305.4.0-1028.325.4.0-1031.365.4.0-1032.37
5.4.0-1033.38
linux-gcp-fips
Ubuntu:Pro:FIPS-updates:20.04:LTS
 before 5.4.0-1067.71~20.04.1, plus listed versions
5.4.0-1021.21+fips1
5.4.0-1067.71~20.04.1
linux-aws-fips
Ubuntu:Pro:FIPS:20.04:LTS
 All versions, plus listed versions
5.4.0-1021.21+fips2
 None known
linux-azure-fips
Ubuntu:Pro:FIPS:20.04:LTS
 All versions, plus listed versions
5.4.0-1022.22+fips1
 None known
linux-fips
Ubuntu:Pro:FIPS:20.04:LTS
 All versions, plus listed versions
5.4.0-1007.8
 None known
linux-gcp-fips
Ubuntu:Pro:FIPS:20.04:LTS
 All versions, plus listed versions
5.4.0-1021.21+fips1
 None known
linux-intel-iot-realtime
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.15.0-1073.75
 None known
linux-realtime
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.15.0-1032.35
 None known
linux-raspi-realtime
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.8.0-2019.20
 None known
kernel-debug
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 5.3.18-lp152.84.1
5.3.18-lp152.84.1
kernel-default
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 5.3.18-lp152.84.1
5.3.18-lp152.84.1
kernel-default-base
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 5.3.18-lp152.84.1.lp152.8.38.1
5.3.18-lp152.84.1.lp152.8.38.1
kernel-docs
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 5.3.18-lp152.84.1
5.3.18-lp152.84.1
kernel-kvmsmall
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 5.3.18-lp152.84.1
5.3.18-lp152.84.1
kernel-obs-build
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 5.3.18-lp152.84.1
5.3.18-lp152.84.1
kernel-obs-qa
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 5.3.18-lp152.84.1
5.3.18-lp152.84.1
kernel-preempt
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 5.3.18-lp152.84.1
5.3.18-lp152.84.1
kernel-source
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 5.3.18-lp152.84.1
5.3.18-lp152.84.1
kernel-syms
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 5.3.18-lp152.84.1
5.3.18-lp152.84.1
kernel-azure
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-38.17.1
5.3.18-38.17.1
kernel-source-azure
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-38.17.1
5.3.18-38.17.1
kernel-syms-azure
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-38.17.1
5.3.18-38.17.1
dtb-aarch64
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-64kb
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-debug
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-default
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-default-base
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1.18.10.1
5.3.18-59.19.1.18.10.1
kernel-docs
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-kvmsmall
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-obs-build
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-obs-qa
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-preempt
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-source
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-syms
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1
kernel-zfcpdump
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 5.3.18-59.19.1
5.3.18-59.19.1

History

History
RecordedChangedSources
affectedOSV
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-35039 is a high vulnerability (CVSS 7.8) in Debian Linux, published July 7, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in kernel 5.10.78.1-1.

References

Show 156 moreShow less
This page doesn't list everything

Left out here: 158 versions and the rest of 9 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open