CVE-2021-28660: Debian Linux

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 33 only
• Linux Linux Kernel: from 3.12, before 4.4.262 (fixed in 4.4.262); from 4.5, before 4.9.262 (fixed in 4.9.262); from 4.10, before 4.14.226 (fixed in 4.14.226); from 4.15, before 4.19.181 (fixed in 4.19.181); from 4.20, before 5.4.106 (fixed in 5.4.106); from 5.5, before 5.10.24 (fixed in 5.10.24); …
• Netapp Cloud Backup: affected versions not specified
• Netapp h300e Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500e Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified

Published 2021-03-17. Last modified 2026-06-17.