CVE-2021-38166: Debian Linux

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Linux Linux Kernel: from 5.6, before 5.10.60 (fixed in 5.10.60); from 5.11, before 5.13.12 (fixed in 5.13.12)

Published 2021-08-07. Last modified 2026-10-08.