Vulnpedia
← All CVEs

CVE-2021-3640

HIGH 7 ALL-YEARS

Published 2022-03-03 · Last modified 2024-08-03 · redhat · NVD: Modified

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

ELEVATED IMPACT

Severe if exploited (CVSS 7), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 31st percentile

○ In CISA KEV○ Catalogued PoC

Impact if exploited

7CVSS 3.1 · HIGH · NVD

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Linux Debian Fedoraproject Canonical Netapp

Products Kernel Linux Kernel Debian Linux Fedora Ubuntu Linux H300s Firmware H300s H700s Firmware H700s H300e Firmware H300e H500e Firmware H500e H700e Firmware H700e H410s Firmware H410s H410c Firmware H410c H500s Firmware H500s

Weakness (CWE)

  • CWE-362: - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-416 - Use After Free.
  • CWE-416: Use after free

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 518 vendor product statements; 486 omitted. Read the full vendor advisory.

  • bpftool-debuginfo-0:4.18.0-372.91.1.el8_6.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-zfcpdump-devel-0:5.14.0-162.6.1.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-debug-modules-0:4.18.0-372.91.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • perf-0:4.18.0-372.91.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-debug-devel-0:4.18.0-425.3.1.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • perf-0:4.18.0-425.3.1.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-debug-modules-0:5.14.0-162.6.1.el9_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • python3-perf-debuginfo-0:5.14.0-162.6.1.el9_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • perf-debuginfo-0:4.18.0-425.3.1.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-rt-devel-0:4.18.0-425.3.1.rt7.213.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-rt-modules-extra-0:5.14.0-162.6.1.rt21.168.el9_1.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • bpftool as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/bpftool

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-alt.src as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-alt?arch=src

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-debug-devel as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug-devel

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-doc as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-doc

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-kdump-devel as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-kdump-devel

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-debug-devel

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-doc

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-rt-trace-devel as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-trace-devel

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-rt.src as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt?arch=src

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-tools-libs-devel

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • python-perf as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-perf

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel

    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-abi-whitelists as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-abi-whitelists

    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-debug as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug

    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-debug-devel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug-devel

    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-doc as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-doc

    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-firmware as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-firmware

    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-kdump as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-kdump

    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • kernel-kdump-devel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-kdump-devel

    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • perf as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/perf

    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00
  • python-perf as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/python-perf

    Red Hat · CVE-2021-3640 · Updated 2026-06-28T05:52:48+00:00

Known Affected Software Configurations

VendorProductVersion range
LinuxLinux Kernel< 4.4.293
LinuxLinux Kernel≥ 4.5 and < 4.9.291
LinuxLinux Kernel≥ 4.10 and < 4.14.256
LinuxLinux Kernel≥ 4.15 and < 4.19.218
LinuxLinux Kernel≥ 4.20 and < 5.4.160
LinuxLinux Kernel≥ 5.5.0 and < 5.10.80
LinuxLinux Kernel≥ 5.11 and < 5.14.19
LinuxLinux Kernel≥ 5.15 and < 5.15.3
DebianDebian Linux9.0
FedoraprojectFedora34
CanonicalUbuntu Linux14.04
CanonicalUbuntu Linux16.04
CanonicalUbuntu Linux18.04
CanonicalUbuntu Linux20.04
CanonicalUbuntu Linux21.10
NetappH300s Firmware*
NetappH700s Firmware*
NetappH300e Firmware*
NetappH500e Firmware*
NetappH700e Firmware*
NetappH410s Firmware*
NetappH410c Firmware*
NetappH500s Firmware*

All CVSS metrics

  • HIGH 7 v3.1 · NVD Primary
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • MEDIUM 6.9 v2.0 · NVD Primary
    AV:L/AC:M/Au:N/C:C/I:C/A:C

References

Exploit-tagged references (not proof of a PoC)

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS