CVE-2021-41840

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that...

8.2 High

An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.30%Down 0.1 points since Feb 3, 2022

What each source reports

NVD Score used 8.2

Record: CVE-2021-41840
CVSS 3.1: 8.2 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-770
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-41840
Updated: 2026-11-02

EUVDEUVD-2021-28841 No score

Record: EUVD-2021-28841
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9fr3-m8v5-v6g9 8.2

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that...

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated table variable EFI_BOOT_SERVICES. This allows an attacker who is capable of executing code in DXE phase to exploit this vulnerability to escalate privileges to SMM. The attacker can overwrite the LocateProtocol or Freepool memory address location to execute unwanted code.

Record: GHSA-9fr3-m8v5-v6g9
CVSS 3.1: 8.2 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-770
Updated: 2026-11-02

Affected products

Show 6 moreShow less

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41840 is a high vulnerability (CVSS 8.2) in Insyde Insydeh2o, published February 3, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. No source names a fixed version.