CVE-2021-38604: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days.

In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.

Affected products

• Fedoraproject Fedora: version 35 only
• GNU Glibc: up to and including 2.34
• Oracle Communications Cloud Native Core Binding Support Function: version 22.1.3 only
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 22.1.0 only
• Oracle Communications Cloud Native Core Network Repository Function: version 22.1.2 only; version 22.2.0 only
• Oracle Communications Cloud Native Core Security Edge Protection Proxy: version 22.1.1 only
• Oracle Communications Cloud Native Core Unified Data Repository: version 22.2.0 only
• Oracle Enterprise Operations Monitor: version 4.3 only; version 4.4 only; version 5.0 only

Published 2021-08-12. Last modified 2026-06-17.