CVE-2021-3752: Debian Linux

High severity, CVSS 7.1. EPSS: 1.7% chance of exploitation in the next 30 days.

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 34 only
• Linux Linux Kernel: from 2.6.12, before 4.4.293 (fixed in 4.4.293); from 4.5, before 4.9.291 (fixed in 4.9.291); from 4.10, before 4.14.256 (fixed in 4.14.256); from 4.15, before 4.19.218 (fixed in 4.19.218); from 4.20, before 5.4.160 (fixed in 5.4.160); from 5.5, before 5.10.80 (fixed in 5.10.80); …
• Netapp h300e Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500e Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Oracle Communications Cloud Native Core Binding Support Function: version 22.1.3 only
• Oracle Communications Cloud Native Core Network Exposure Function: version 22.1.1 only
• Oracle Communications Cloud Native Core Policy: version 22.2.0 only
• Red Hat 3scale: version 2.0 only
• Red Hat Enterprise Linux: version 7.0 only; version 8.0 only
• Red Hat Enterprise Linux For Real Time: version 7 only
• Red Hat Enterprise Linux For Real Time For Nfv: version 7 only
• Red Hat Virtualization Host: version 4.0 only

Published 2022-02-16. Last modified 2026-06-17.