CVE-2021-29154 is a high-severity vulnerability in the Linux kernel's BPF JIT compilers (versions through 5.11.12) affecting Debian, Fedora, and NetApp products. It allows a local attacker to execute arbitrary code within the kernel context due to incorrect computation of branch displacements. While the CVSS score is 7.8, indicating high impact on confidentiality, integrity, and availability, there is currently no public exploit code (Metasploit, Nuclei, ExploitDB) and it is not listed on the KEV catalog. Community discussion is minimal, with only one Reddit mention, suggesting limited public awareness or active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.0, < 4.4.266CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.5, < 4.9.266CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.10, < 4.14.230CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.15, < 4.19.186CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.20, < 5.4.111CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2021-29154
Mar 14, 2023BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.
Apr 13, 2021kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation
Apr 8, 2021