CVE-2021-3490Linux kernel Memory Corruption
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution.
Published Jun 4, 2021 · Updated Oct 14, 2026 · Also known as A-190876666, DEBIAN-CVE-2021-3490, PUB-A-190876666, UBUNTU-CVE-2021-3490
Key Facts
Patch immediately- CVE-2021-3490 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Ubuntu Linux (Canonical), Linux kernel, linux (arch) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 27% probability of exploitation in the next 30 days.
- Fixed versions are available, including :linux_kernel: :2021-10-05, bpftool 5.10.25-7.ph4, cluster-md-kmp-64kb 5.3.18-59.5.2.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
27%
Higher than 98.0% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
57/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
2
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37.
The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
Affected Products
183 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Ubuntu LinuxCanonical | 20.04, 20.10, 21.04 | n/a |
| Linux kernelLinux | 5.13, 5.13-rc1, 5.13-rc2, 5.13-rc3, >= trunk | 5.10.37 |
| linuxarch | See advisory | 5.12.4.arch1-1 |
| linux-hardenedarch | See advisory | 5.11.21.hardened1-1 |
| linux-ltsarch | See advisory | 5.10.37-1 |
Patched Releases
:linux_kernel:
:2021-10-05
bpftool
5.10.25-7.ph4
cluster-md-kmp-64kb
5.3.18-59.5.2
cluster-md-kmp-azure
5.3.18-38.3.1
cluster-md-kmp-default
5.3.18-59.5.2
cluster-md-kmp-preempt
5.3.18-59.5.2
dlm-kmp-64kb
5.3.18-59.5.2
dlm-kmp-azure
5.3.18-38.3.1
dlm-kmp-default
5.3.18-59.5.2
dlm-kmp-preempt
5.3.18-59.5.2
gfs2-kmp-64kb
5.3.18-59.5.2
gfs2-kmp-azure
5.3.18-38.3.1
gfs2-kmp-default
5.3.18-59.5.2
gfs2-kmp-preempt
5.3.18-59.5.2
kernel-64kb
5.3.18-59.5.2
kernel-64kb-devel
5.3.18-59.5.2
kernel-64kb-extra
5.3.18-59.5.2
kernel-64kb-livepatch-devel
5.3.18-59.5.2
kernel-64kb-optional
5.3.18-59.5.2
kernel-azure
5.3.18-38.3.1
kernel-azure-devel
5.3.18-38.3.1
kernel-azure-extra
5.3.18-38.3.1
kernel-azure-livepatch-devel
5.3.18-38.3.1
kernel-azure-optional
5.3.18-38.3.1
kernel-debug
5.3.18-59.5.2
Timeline
Publicly disclosed
Jun 4, 2021
Last updated
Oct 14, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-125 Out-of-bounds Read
- CWE-787 Out-of-bounds Write
References
- advisorysecurity-tracker.debian.org · CVE-2021-3490
- advisoryubuntu.com · CVE-2021-3490
- advisorycve.org · CVERecord
- advisorybugzilla.suse.com · 1043990
- advisorybugzilla.suse.com · 1047233
FAQ
Common Questions.
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution.
Affected: Ubuntu Linux (Canonical) versions 20.04, 20.10, 21.04; Linux kernel versions 5.13, 5.13-rc1, 5.13-rc2, 5.13-rc3, >= trunk; linux (arch), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including :linux_kernel: :2021-10-05, bpftool 5.10.25-7.ph4, cluster-md-kmp-64kb 5.3.18-59.5.2.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2021-3490 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo