CVE-2021-26398

Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or...

7.8 High

Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which may lead to potential arbitrary code execution.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.22%Down 2.3 points since Jan 11, 2023

What each source reports

NVD Score used 7.8

Record: CVE-2021-26398
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

CVE List 7.8

Record: CVE-2021-26398
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2021-13204 7.8

Record: EUVD-2021-13204
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j4gm-gvp6-xh87 7.8

Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or...

Record: GHSA-j4gm-gvp6-xh87
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-20, CWE-787
Updated: 2026-11-02

Affected products

Show 55 moreShow less

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-26398 is a high vulnerability (CVSS 7.8) in Amd 1st Gen Epyc, published January 10, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.