vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-3491

Linux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypass

HIGH
8.8
CVSS Score
Published: June 4, 2021 at 01:40 AM UTC
Updated: June 17, 2026 at 04:05 AM UTC
2 products affected across 2 vendorsLinux KernelUbuntu Linux

Using Linux kernel by Linux?

Get instant alerts when new vulnerabilities affect Linux kernel - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 0.6%

Description

The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux· Canonicalrubygems
95%
20.0420.1021.04
Linux Kernel· Linux
95%
5.11 ≤ v < 5.11.215.12 ≤ v < 5.12.45.7 ≤ v < 5.10.37linux-5.10.y ≤ v < v5.10.37linux-5.11.y ≤ v < v5.11.21linux-5.12.y ≤ v < v5.12.4trunk ≤ v < v5.13-rc4v5.7-rc1 ≤ v < 5.7*5.10.y5.11.y5.12.y5.7-rc1trunk
Affected range stops below 5.10.37, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.11.21, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.12.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.7*, so it looks safe — our inference, not a vendor statement
Affected range stops below v5.10.37, so it looks safe — our inference, not a vendor statement
Affected range stops below v5.11.21, so it looks safe — our inference, not a vendor statement
Affected range stops below v5.12.4, so it looks safe — our inference, not a vendor statement
Affected range stops below v5.13-rc4, so it looks safe — our inference, not a vendor statement

References (6)

x_refsource_MISCPatchVendor Advisory
Source: [email protected]
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d1f82808877bb10d3deee7cf3374a4eb3fb582db
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://security.netapp.com/advisory/ntap-20210716-0004/
Vendor Advisoryx_refsource_UBUNTUThird Party Advisory
Source: [email protected]
https://ubuntu.com/security/notices/USN-4949-1
Vendor Advisoryx_refsource_UBUNTUThird Party Advisory
Source: [email protected]
https://ubuntu.com/security/notices/USN-4950-1
Mailing Listx_refsource_MLISTPatchThird Party Advisory
Source: [email protected]
https://www.openwall.com/lists/oss-security/2021/05/11/13
x_refsource_MISCThird Party AdvisoryVDB Entry
Source: [email protected]
https://www.zerodayinitiative.com/advisories/ZDI-21-589/

CVSS

8.8HIGH[email protected]
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-131CWE-787

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card