CVE-2021-33200: Fedoraproject Fedora

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.

Affected products

• Fedoraproject Fedora: version 33 only; version 34 only
• Linux Linux Kernel: from 5.4.116, before 5.4.123 (fixed in 5.4.123); from 5.10.33, before 5.10.41 (fixed in 5.10.41); from 5.11.17, before 5.12.8 (fixed in 5.12.8)
• Netapp Cloud Backup: affected versions not specified
• Netapp h300e Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500e Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Solidfire & Hci Management Node: affected versions not specified
• Netapp Solidfire Baseboard Management Controller: affected versions not specified

Published 2021-05-27. Last modified 2026-06-17.