CVE-2021-42252: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.

Affected products

• Linux Linux Kernel: from 4.12, before 4.14.247 (fixed in 4.14.247); from 4.15, before 4.19.207 (fixed in 4.19.207); from 4.20, before 5.4.148 (fixed in 5.4.148); from 5.5, before 5.10.67 (fixed in 5.10.67); from 5.11, before 5.13.19 (fixed in 5.13.19); from 5.14, before 5.14.6 (fixed in 5.14.6)
• Netapp Cloud Backup: affected versions not specified
• Netapp h300e Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500e Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified

Published 2021-10-11. Last modified 2026-08-05.