VDB
CVE-2021-3501
CVE-2021-3501
PUBLISHED
Reported by redhat · Published May 5, 2021
A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| linux-oem-5.10 | Ubuntu:20.04:LTS | 5.10.0-1029.30 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | kernel | 5.9, 5.11 |
| n/a | kernel | Linux kernel 5.12 |
| arch | linux-lts | 0 |
| Linux | kernel | 5.11, 5.9 |
| arch | linux-hardened | 0 |
| arch | linux-zen | 0 |
| arch | linux | 0 |
Timeline
- May 5, 2021 CVE Published
- May 7, 2021 EPSS Score (30 in total, the first dated here)
- Mar 7, 2026 Distribution Patch (12 in total, the first dated here)
- Mar 7, 2026 Security Advisory (14 in total, the first dated here)
- Jul 29, 2026 Coalition ESS Score
- Aug 5, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-3501
vulnetix vdb fixes CVE-2021-3501Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-3501/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart