critical 9.8

CVE-2021-43267 in the critical feed json

An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16.

published 2021-11-02 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-30211

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 57.9%; EPSS 57.9% chance of exploitation in 30 days, percentile 99%
public exploits: 0; none known

An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.

Patch / fix

fixed in 1 distros 6 links 1

linux linux_kernel 5.10.77, 5.14.16

debian ubuntu red hat rocky linux azure linux arch linux

linux Debian 14, Debian 13, Debian 12 5.14.16-1

debian advisories DEBIAN-CVE-2021-43267

linux-aws-5.11 Ubuntu 20.04 LTS 5.11.0-1023.24~20.04.1
linux-gcp-5.11 Ubuntu 20.04 LTS 5.11.0-1024.26~20.04.1
linux-hwe-5.11 Ubuntu 20.04 LTS 5.11.0-44.48~20.04.2
linux-hwe-5.13 Ubuntu 20.04 LTS 5.13.0-23.23~20.04.2
linux-oem-5.10 Ubuntu 20.04 LTS 5.10.0-1053.55
linux-oem-5.13 Ubuntu 20.04 LTS 5.13.0-1026.32
linux-oem-5.14 Ubuntu 20.04 LTS 5.14.0-1008.8
linux-azure-5.11 Ubuntu 20.04 LTS 5.11.0-1023.24~20.04.1

ubuntu advisories UBUNTU-CVE-2021-43267

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

redhat-virtualization-host rhev hypervisor 4.4 4.4.9-202111172338_8.5
redhat-virtualization-host-image-update rhev hypervisor 4.4 4.4.9-202111172338_8.5
kernel-rt RHEL 8 4.18.0-348.2.1.rt7.132.el8_5
kernel-rt-kvm RHEL 8 4.18.0-348.2.1.rt7.132.el8_5
kernel-rt-core RHEL 8 4.18.0-348.2.1.rt7.132.el8_5
kernel-rt-modules RHEL 8 4.18.0-348.2.1.rt7.132.el8_5
kernel-rt-debug-kvm RHEL 8 4.18.0-348.2.1.rt7.132.el8_5
kernel-rt-debug-core RHEL 8 4.18.0-348.2.1.rt7.132.el8_5

red hat advisories RHSA-2021:4750 RHSA-2021:4646 RHSA-2021:4647 RHSA-2021:4648 RHSA-2021:4650 RHSA-2021:4644

kernel Rocky Linux 8 4.18.0-348.2.1.el8_5
kernel-rt Rocky Linux 8 4.18.0-348.2.1.rt7.132.el8_5

rocky linux advisories RLSA-2021:4647 RLSA-2021:4646

kernel CBL-Mariner 2.0 5.10.78.1-1

azure linux advisories AZL-6603

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

linux-hardened Arch Linux 5.14.16.hardened1-1
linux Arch Linux 5.14.16.arch1-1
linux-zen Arch Linux 5.14.16.zen1-1
linux-lts Arch Linux 5.10.77-1

arch linux advisories AVG-2499 AVG-2513 AVG-2514 AVG-2515

github.com/torvalds/linux@fa40d97 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-43267 updated 2026-11-07 cvss 8.8

kernel: Insufficient validation of user-supplied sizes for the MSG_CRYPTO message type

Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-348.2.1.el8_5, kernel-debuginfo-common-aarch64 4.18.0-348.2.1.el8_5, kernel-debuginfo-common-ppc64le 4.18.0-348.2.1.el8_5 Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-348.2.1.el8_5, kernel 4.18.0-348.2.1.el8_5, bpftool 4.18.0-348.2.1.el8_5, kpatch-patch-4_18_0-348 1-1.el8, kernel-core 4.18.0-348.2.1.el8_5, kernel-tools 4.18.0-348.2.1.el8_5, +16 more
fixed: vendor fix RHSA-2021:4647
Red Hat Enterprise Linux BaseOS EUS (v.8.4) perf 4.18.0-305.28.1.el8_4, kernel 4.18.0-305.28.1.el8_4, bpftool 4.18.0-305.28.1.el8_4, kpatch-patch-4_18_0-305 1-8.el8, kernel-core 4.18.0-305.28.1.el8_4, kernel-tools 4.18.0-305.28.1.el8_4, +23 more Red Hat Enterprise Linux CRB EUS (v.8.4) kernel-debuginfo-common-x86_64 4.18.0-305.28.1.el8_4, kernel-debuginfo-common-aarch64 4.18.0-305.28.1.el8_4, kernel-debuginfo-common-ppc64le 4.18.0-305.28.1.el8_4
fixed: vendor fix RHSA-2021:4650
Red Hat Enterprise Linux for Real Time (v. 8) kernel-rt 4.18.0-348.2.1.rt7.132.el8_5, kernel-rt-core 4.18.0-348.2.1.rt7.132.el8_5, kernel-rt-modules 4.18.0-348.2.1.rt7.132.el8_5, kernel-rt-debug-core 4.18.0-348.2.1.rt7.132.el8_5, kernel-rt-debug-modules 4.18.0-348.2.1.rt7.132.el8_5, kernel-rt-modules-extra 4.18.0-348.2.1.rt7.132.el8_5, +2 more
fixed: vendor fix RHSA-2021:4646
Red Hat Enterprise Linux NFV EUS (v.8.4) kernel-rt 4.18.0-305.28.1.rt7.100.el8_4, kernel-rt-kvm 4.18.0-305.28.1.rt7.100.el8_4, kernel-rt-core 4.18.0-305.28.1.rt7.100.el8_4, kernel-rt-modules 4.18.0-305.28.1.rt7.100.el8_4, kernel-rt-debug-kvm 4.18.0-305.28.1.rt7.100.el8_4, kernel-rt-debug-core 4.18.0-305.28.1.rt7.100.el8_4, +4 more
fixed: vendor fix RHSA-2021:4648
Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-348.2.1.rt7.132.el8_5, kernel-rt-kvm 4.18.0-348.2.1.rt7.132.el8_5, kernel-rt-core 4.18.0-348.2.1.rt7.132.el8_5, kernel-rt-modules 4.18.0-348.2.1.rt7.132.el8_5, kernel-rt-debug-kvm 4.18.0-348.2.1.rt7.132.el8_5, kernel-rt-debug-core 4.18.0-348.2.1.rt7.132.el8_5, +4 more
fixed: vendor fix RHSA-2021:4646
Red Hat Enterprise Linux RT EUS (v.8.4) kernel-rt 4.18.0-305.28.1.rt7.100.el8_4, kernel-rt-core 4.18.0-305.28.1.rt7.100.el8_4, kernel-rt-modules 4.18.0-305.28.1.rt7.100.el8_4, kernel-rt-debug-core 4.18.0-305.28.1.rt7.100.el8_4, kernel-rt-debug-modules 4.18.0-305.28.1.rt7.100.el8_4, kernel-rt-modules-extra 4.18.0-305.28.1.rt7.100.el8_4, +2 more
fixed: vendor fix RHSA-2021:4648
Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.4.9-202111172338_8.5, redhat-virtualization-host-image-update 4.4.9-202111172338_8.5
fixed: vendor fix RHSA-2021:4750
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.4.9-2.el8ev, redhat-release-virtualization-host-content 4.4.9-2.el8ev, redhat-virtualization-host-image-update-placeholder 4.4.9-2.el8ev
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

57.85% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

openwall.com http://www.openwall.com/lists/oss-security/2022/02/10/1 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-1284 Improper Validation of Specified Quantity in Input

Technology feeds

Linux kernel rss critical rss

References

github.com /torvalds/linux/commit/fa40d9734a57bcbfa79a280189799f76c88f7bb0
patch, third-party-advisory
openwall.com /lists/oss-security/2022/02/10/1
mailing-list, exploit, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/CVWL7HZV5T5OEKJPO2D67RMFMKBBXGGB/
vendor-advisory
cdn.kernel.org /pub/linux/kernel/v5.x/ChangeLog-5.14.16
mailing-list, release-notes, vendor-advisory
security.netapp.com /advisory/ntap-20211125-0002/
third-party-advisory

Sources

CVE List CVE-2021-43267
NVD CVE-2021-43267

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary