CVE-2021-3930: Debian Linux

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Qemu Qemu: before 6.2.0 (fixed in 6.2.0)
• Red Hat Codeready Linux Builder: version 8.0 only
• Red Hat Codeready Linux Builder For IBM Z Systems: version 8.0 only
• Red Hat Codeready Linux Builder For Power Little Endian: version 8.0 only
• Red Hat Enterprise Linux: version 8.0 only
• Red Hat Enterprise Linux Advanced Virtualization Eus: version 8.4 only
• Red Hat Enterprise Linux For IBM Z Systems: version 8.0 only
• Red Hat Enterprise Linux For Power Little Endian: version 8.0 only
• Red Hat Openstack: version 10 only; version 13 only

Published 2022-02-18. Last modified 2026-06-17.