CVE-2021-3667: Debian Linux

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

Affected products

• Debian Debian Linux: version 10.0 only
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Red Hat Enterprise Linux: version 8.0 only
• Red Hat Libvirt: from 4.1.0, up to and including 7.5.0

Published 2022-03-02. Last modified 2026-06-17.