medium 6.8

CVE-2021-4203 json

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and c…

published 2022-03-25 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-34061

cvss: 6.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits: 0; none known

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.

Patch / fix

fixed in 1 distros 6 links 4

linux linux_kernel 5.15

debian ubuntu red hat suse almalinux rocky linux

linux Debian 14, Debian 13, Debian 12 5.14.12-1

debian advisories DEBIAN-CVE-2021-4203

linux Ubuntu 18.04 LTS 4.15.0-163.171
linux Ubuntu 20.04 LTS 5.4.0-91.102
linux-aws Ubuntu 18.04 LTS 4.15.0-1116.123
linux-aws Ubuntu 20.04 LTS 5.4.0-1060.63
linux-gcp Ubuntu 20.04 LTS 5.4.0-1058.62
linux-gke Ubuntu 20.04 LTS 5.4.0-1056.59
linux-ibm Ubuntu 20.04 LTS 5.4.0-1008.9
linux-kvm Ubuntu 18.04 LTS 4.15.0-1103.105

ubuntu advisories UBUNTU-CVE-2021-4203

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 8 4.18.0-372.9.1.el8
perf RHEL 8 4.18.0-372.9.1.el8
bpftool RHEL 8 4.18.0-372.9.1.el8
kernel-core RHEL 8 4.18.0-372.9.1.el8
kernel-tools RHEL 8 4.18.0-372.9.1.el8
python3-perf RHEL 8 4.18.0-372.9.1.el8
kernel-modules RHEL 8 4.18.0-372.9.1.el8
kernel-zfcpdump RHEL 8 4.18.0-372.9.1.el8

red hat advisories RHSA-2022:1988 RHSA-2022:5626 RHSA-2022:5633 RHSA-2022:1975

kernel-default SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE Live Patching 15 SP1 +3 more 4.12.14-150100.197.142.1
kernel-vanilla openSUSE Leap 15.4 4.12.14-150100.197.142.1
kernel-kvmsmall openSUSE Leap 15.4 4.12.14-150100.197.142.1
kernel-zfcpdump SLES 15 SP1-LTSS, openSUSE Leap 15.4 4.12.14-150100.197.142.1
drbd SLE High Availability Extension 12 SP4 9.0.14+git.62f906cf-4.26.2
kernel-syms SLES 12 SP4-LTSS, SLES 12 SP4-ESPOS, OpenStack Cloud Crowbar 9 +1 more 4.12.14-95.125.1
kernel-source SLES 12 SP4-LTSS, SLES 12 SP4-ESPOS, OpenStack Cloud Crowbar 9 +1 more 4.12.14-95.125.1
kernel-default SLES 12 SP4-LTSS, SLES 12 SP4-ESPOS, SLE Live Patching 12 SP4 +3 more 4.12.14-95.125.1

suse advisories SUSE-SU-2023:1848-1 SUSE-SU-2023:2232-1 SUSE-SU-2023:0852-1 SUSE-SU-2023:0768-1 SUSE-SU-2023:0747-1 SUSE-SU-2023:0634-1

kernel AlmaLinux 8 4.18.0-372.9.1.el8
perf AlmaLinux 8 4.18.0-372.9.1.el8
bpftool AlmaLinux 8 4.18.0-372.9.1.el8
kernel-core AlmaLinux 8 4.18.0-372.9.1.el8
kernel-tools AlmaLinux 8 4.18.0-372.9.1.el8
python3-perf AlmaLinux 8 4.18.0-372.9.1.el8
kernel-modules AlmaLinux 8 4.18.0-372.9.1.el8
kernel-debug-core AlmaLinux 8 4.18.0-372.9.1.el8

almalinux advisories ALSA-2022:1988

kernel Rocky Linux 8 4.18.0-372.9.1.el8
kernel-rt Rocky Linux 8 4.18.0-372.9.1.rt7.166.el8

rocky linux advisories RLSA-2022:1988 RLSA-2022:1975

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-4203 updated 2026-11-07 cvss 5.8

kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: workaround, no fix available
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-372.9.1.el8, kernel 4.18.0-372.9.1.el8, bpftool 4.18.0-372.9.1.el8, kernel-core 4.18.0-372.9.1.el8, kernel-tools 4.18.0-372.9.1.el8, python3-perf 4.18.0-372.9.1.el8, +15 more
fixed: vendor fix RHSA-2022:1988
Red Hat Enterprise Linux BaseOS EUS (v.8.4) perf 4.18.0-305.57.1.el8_4, kernel 4.18.0-305.57.1.el8_4, bpftool 4.18.0-305.57.1.el8_4, kernel-core 4.18.0-305.57.1.el8_4, kernel-tools 4.18.0-305.57.1.el8_4, python3-perf 4.18.0-305.57.1.el8_4, +15 more
fixed: vendor fix RHSA-2022:5626
Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-372.9.1.el8, kernel-debuginfo-common-aarch64 4.18.0-372.9.1.el8, kernel-debuginfo-common-ppc64le 4.18.0-372.9.1.el8
fixed: vendor fix RHSA-2022:1988
Red Hat Enterprise Linux CRB EUS (v.8.4) kernel-debuginfo-common-x86_64 4.18.0-305.57.1.el8_4, kernel-debuginfo-common-aarch64 4.18.0-305.57.1.el8_4, kernel-debuginfo-common-ppc64le 4.18.0-305.57.1.el8_4
fixed: vendor fix RHSA-2022:5626
Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-372.9.1.rt7.166.el8, kernel-rt-kvm 4.18.0-372.9.1.rt7.166.el8, kernel-rt-core 4.18.0-372.9.1.rt7.166.el8, kernel-rt-modules 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-kvm 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-core 4.18.0-372.9.1.rt7.166.el8, +4 more
fixed: vendor fix RHSA-2022:1975
Red Hat Enterprise Linux NFV EUS (v.8.4) kernel-rt 4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-kvm 4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-core 4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-modules 4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-debug-kvm 4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-debug-core 4.18.0-305.57.1.rt7.129.el8_4, +4 more
fixed: vendor fix RHSA-2022:5633
Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-372.9.1.rt7.166.el8, kernel-rt-core 4.18.0-372.9.1.rt7.166.el8, kernel-rt-modules 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-core 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-modules 4.18.0-372.9.1.rt7.166.el8, kernel-rt-modules-extra 4.18.0-372.9.1.rt7.166.el8, +2 more
fixed: vendor fix RHSA-2022:1975

show 2 more

Red Hat Enterprise Linux RT EUS (v.8.4) kernel-rt 4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-core 4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-modules 4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-debug-core 4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-debug-modules 4.18.0-305.57.1.rt7.129.el8_4, kernel-rt-modules-extra 4.18.0-305.57.1.rt7.129.el8_4, +2 more
fixed: vendor fix RHSA-2022:5633
Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.75% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

bugs.chromium.org https://bugs.chromium.org/p/project-zero/issues/detail?id=2230&can=7&q=modified-after%3Atoday-30&sort=-modified&colspec=ID%20Type%20Status%20Priority%20Milestone%20Owner%20Summary%20Modified%20Cve&cells=tiles&redir=1 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.8	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD	2.0	4.9	AV:N/AC:M/Au:S/C:P/I:N/A:P

Affected products

n/a kernel

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
CWE-416 Use After Free

Technology feeds

Linux kernel rss critical rss

References

git.kernel.org /pub/scm/linux/kernel/git/netdev/net.git/commit/?id=35306eb23814
patch, vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=2036934
issue-tracking, patch, third-party-advisory
bugs.chromium.org /p/project-zero/issues/detail?id=2230&can=7&q=modified-after%3Atoday-30&sort=-modified&colspec=ID%20Type%20Sta
exploit, issue-tracking, patch, third-party-advisory
oracle.com /security-alerts/cpujul2022.html
patch, third-party-advisory
lore.kernel.org /netdev/20210929225750.2548112-1-eric.dumazet%40gmail.com/T/
security.netapp.com /advisory/ntap-20221111-0003/
third-party-advisory

Sources

CVE List CVE-2021-4203
NVD CVE-2021-4203

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary