cve.bz

CVE-2021-3640

7.0 highEPSS 0.4%

High (7.0). EPSS 0.4% chance of exploitation in the next 30 days.

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

Severity

CVSS 3.1

7.0 high
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-11-01)
CWEs
CWE-362, CWE-416
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON