CVE-2021-33574: Debian Linux

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• GNU Glibc: version 2.32 only; version 2.33 only
• Netapp Cloud Backup: affected versions not specified
• Netapp E-Series Santricity OS Controller: from 11.0, up to and including 11.70.1
• Netapp h300e Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500e Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified

Published 2021-05-25. Last modified 2026-06-17.