01 Record

CVE-2021-3347

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka

HighPUBLISHEDCNA: mitre

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka

03 Exploitation and scoring

Exploitation

Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.

SSVC decision

ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

1.38% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 70.1% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2021-01-29 16:56Z5 YR AGO

Last updated

2026-02-25 17:10Z6 MO AGO

Reserved

2021-01-29

Assigning CNA

mitre

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

4ba51c732ffe8da033785971ba4cfa5b02435f1c9419861462b5855675d8496d

05 Affected products

VendorProductVersionsPlatforms

debiandebian_linuxNot specified—

fedoraprojectfedoraNot specified—

linuxlinux_kernelNot specified—

redhatenterprise_linuxNot specified—

redhatrhel_ausNot specified—

redhatrhel_e4sNot specified—

redhatrhel_elsNot specified—

redhatrhel_eusNot specified—

redhatrhel_extras_rtNot specified—

redhatrhel_tusNot specified—

06 References

git.kernel.orghttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c64396cc36c6e60704ab06c1fb1c4a46179c9120x_refsource_MISC
git.kernel.orghttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=34b1a1ce1458f50ef27c54e28eb9b1947012907ax_refsource_MISC
git.kernel.orghttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2dac39d93987f7de1e20b3988c8685523247ae2x_refsource_MISC
git.kernel.orghttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6ccc84f917d33312eb2846bd7b567639f585ad6dx_refsource_MISC
git.kernel.orghttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2156ac1934166d6deb6cd0f6ffc4c1076ec63697x_refsource_MISC
git.kernel.orghttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c5cade200ab9a2a3be9e7f32a752c8d86b502ec7x_refsource_MISC
git.kernel.orghttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04b79c55201f02ffd675e1231d731365e335c307x_refsource_MISC
git.kernel.orghttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9x_refsource_MISC
www.openwall.comhttps://www.openwall.com/lists/oss-security/2021/01/29/3x_refsource_MISC
www.openwall.comhttps://www.openwall.com/lists/oss-security/2021/01/29/1x_refsource_MISC
www.openwall.com[oss-security] 20210129 Re: Linux Kernel: local priv escalation via futexeshttp://www.openwall.com/lists/oss-security/2021/01/29/5mailing-listx_refsource_MLIST
www.openwall.com[oss-security] 20210129 Re: Linux Kernel: local priv escalation via futexeshttp://www.openwall.com/lists/oss-security/2021/01/29/4mailing-listx_refsource_MLIST
www.openwall.com[oss-security] 20210201 Re: Linux Kernel: local priv escalation via futexeshttp://www.openwall.com/lists/oss-security/2021/02/01/4mailing-listx_refsource_MLIST
www.debian.orgDSA-4843https://www.debian.org/security/2021/dsa-4843vendor-advisoryx_refsource_DEBIAN
lists.fedoraproject.orgFEDORA-2021-6e805a5051https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CXAVDAK4RLAHBHHGEPL73UFXSI6BXQ7Q/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2021-879c756377https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOBMXDJABYE76RKNBAWA2E4TSSBX7CSJ/vendor-advisoryx_refsource_FEDORA
lists.debian.org[debian-lts-announce] 20210212 [SECURITY] [DLA 2557-1] linux-4.19 security updatehttps://lists.debian.org/debian-lts-announce/2021/02/msg00018.htmlmailing-listx_refsource_MLIST
security.netapp.comhttps://security.netapp.com/advisory/ntap-20210304-0005/x_refsource_CONFIRM
lists.debian.org[debian-lts-announce] 20210309 [SECURITY] [DLA 2586-1] linux security updatehttps://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlmailing-listx_refsource_MLIST

01 Record index

CVE-2021-3347

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2021-3347

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References