CVE-2021-3600: Canonical Ubuntu Linux

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only
• Fedoraproject Fedora: version 34 only
• Linux Linux Kernel: from 4.14.115, before 4.14.308 (fixed in 4.14.308); from 4.15, before 4.19.206 (fixed in 4.19.206); from 4.20, before 5.4.98 (fixed in 5.4.98); from 5.5, before 5.10.16 (fixed in 5.10.16); version 5.11 only
• Red Hat Enterprise Linux: version 8.0 only

Published 2024-01-08. Last modified 2026-06-17.