medium 5.5

CVE-2021-38198 json

arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to…

published 2021-08-08 5 y ago modified 2026-10-08 31 d ago also EUVD-2021-24656

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 39%
public exploits: 0; none known

arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault.

Patch / fix

fixed in 1 distros 5 links 2

linux linux_kernel 5.12.11

debian ubuntu suse opensuse azure linux

linux Debian 14, Debian 13, Debian 12 5.10.46-1

debian advisories DEBIAN-CVE-2021-38198

linux Ubuntu 18.04 LTS 4.15.0-161.169
linux Ubuntu 20.04 LTS 5.4.0-89.100
linux-aws Ubuntu 18.04 LTS 4.15.0-1114.121
linux-aws Ubuntu 20.04 LTS 5.4.0-1058.61
linux-gcp Ubuntu 20.04 LTS 5.4.0-1056.60
linux-gke Ubuntu 20.04 LTS 5.4.0-1054.57
linux-ibm Ubuntu 20.04 LTS 5.4.0-1006.7
linux-kvm Ubuntu 18.04 LTS 4.15.0-1101.103

ubuntu advisories UBUNTU-CVE-2021-38198

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-syms SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 4.12.14-95.83.2
kernel-source SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 4.12.14-95.83.2
kernel-default SLES for SAP 12 SP4, SLES 12 SP4-LTSS, SLE Live Patching 12 SP4 +3 more 4.12.14-95.83.2
kernel-syms SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.78.1
kernel-source SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.78.1
kernel-default SLES for SAP 15, SLES 15-LTSS, SLE Live Patching 15 +3 more 4.12.14-150.78.1
kernel-vanilla SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.78.1
kernel-obs-build SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.78.2

suse advisories SUSE-SU-2021:3972-1 SUSE-SU-2021:3969-1 SUSE-SU-2021:3935-1 SUSE-SU-2021:3929-1 SUSE-SU-2021:3876-1 SUSE-SU-2021:14849-1

kernel-default openSUSE Leap 15.3 4.12.14-197.102.2
kernel-vanilla openSUSE Leap 15.3 4.12.14-197.102.2
kernel-kvmsmall openSUSE Leap 15.3 4.12.14-197.102.2
kernel-zfcpdump openSUSE Leap 15.3 4.12.14-197.102.2
dtb-aarch64 openSUSE Leap 15.3 5.3.18-59.24.1
kernel-64kb openSUSE Leap 15.3 5.3.18-59.24.1
kernel-syms openSUSE Leap 15.3 5.3.18-59.24.1
kernel-obs-qa openSUSE Leap 15.3 5.3.18-59.24.1

opensuse advisories openSUSE-SU-2021:3876-1 openSUSE-SU-2021:3205-1 openSUSE-SU-2021:3179-1 openSUSE-SU-2021:1271-1

kernel CBL-Mariner 2.0 5.10.78.1-1

azure linux advisories AZL-6582

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/torvalds/linux@b1bd5cb commit
cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.11 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-38198 updated 2026-11-07 cvss 6.4

kernel: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow page

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
affected: workaround, no fix planned “Do not disable hardware-assisted paging (also known as nested paging and Second Level Address Translation) on your hosts. The default is on.”
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
affected: workaround, no fix available “Do not disable hardware-assisted paging (also known as nested paging and Second Level Address Translation) on your hosts. The default is on.”
Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 31 d ago (2026-10-08)

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/torvalds/linux/commit/b1bd5cba3306691c771d558e94baa73e8b0b96b7 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:N/I:N/A:P

Classification

Technology feeds

Linux kernel rss critical rss

References

github.com /torvalds/linux/commit/b1bd5cba3306691c771d558e94baa73e8b0b96b7
exploit, patch, third-party-advisory
cdn.kernel.org /pub/linux/kernel/v5.x/ChangeLog-5.12.11
mailing-list, patch, vendor-advisory
lists.debian.org /debian-lts-announce/2021/10/msg00010.html
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2021/12/msg00012.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2021-38198
NVD CVE-2021-38198

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary