CVE-2021-33034: Debian Linux

High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days.

In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 34 only
• Linux Linux Kernel: before 4.4.269 (fixed in 4.4.269); from 4.5, before 4.9.269 (fixed in 4.9.269); from 4.10, before 4.14.233 (fixed in 4.14.233); from 4.15, before 4.19.191 (fixed in 4.19.191); from 4.20, before 5.4.119 (fixed in 5.4.119); from 5.5, before 5.10.37 (fixed in 5.10.37); …

Published 2021-05-14. Last modified 2026-08-13.