Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-3640

24
FAUCET Score

CVE-2021-3640 is a use-after-free vulnerability in the Linux kernel's HCI subsystem, specifically within the sco_sock_sendmsg() function, affecting various Linux distributions including Canonical, Debian, Fedora, and NetApp. This flaw allows a privileged local user to trigger a race condition, potentially leading to a system crash or privilege escalation. With a CVSS score of 7.0 (HIGH), the attack requires local access and high attack complexity, but can result in high impact to confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 4.4.293CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 4.5, < 4.9.291CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 4.10, < 4.14.256CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 4.15, < 4.19.218CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 4.20, < 5.4.160CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.0HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.0
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.37%
Probability of exploitation in next 30 days
EPSS Percentile
29.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0037 is in the 69th percentile among its peer group of 1,525 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (11)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: cm1 kernel 5.10.102.1-3 on CBL Mariner 1.0Fixed in: -
microsoftpatch availablevia msrc
Product: 18768-16820Fixed in: -
redhatpatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-rt-0:4.18.0-425.3.1.rt7.213.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-0:4.18.0-425.3.1.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: kernel-0:4.18.0-372.91.1.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel-0:5.14.0-162.6.1.el9_1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel-rt-0:5.14.0-162.6.1.rt21.168.el9_1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8Fixed in: kernel-0:4.18.0-372.91.1.el8_6
View patch
ubuntupatch availablevia nvd_reference
View patch

Vendor Advisories (2)

microsoft2022-Mar/CVE-2021-3640Important

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

Mar 8, 2022
redhatCVE-2021-3640Moderate

kernel: use-after-free vulnerability in function sco_sock_sendmsg()

Jul 18, 2021

References

bugzilla.redhat.com / show_bug.cgi
Issue TrackingPatchThird Party Advisory
github.com / torvalds/linux/commit/99c23da0eed4fd20cae8243f2b51e10e66aa0951
PatchThird Party Advisory
git.kernel.org / pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/bluetooth/sco.c
PatchVendor Advisory
lists.debian.org / debian-lts-announce/2022/03/msg00011.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2022/03/msg00012.html
Mailing ListThird Party Advisory
security.netapp.com / advisory/ntap-20220419-0003
Third Party Advisory
ubuntu.com / security/CVE-2021-3640
PatchThird Party Advisory
debian.org / security/2022/dsa-5096
Third Party Advisory
openwall.com / lists/oss-security/2021/07/22/1
ExploitMailing ListThird Party Advisory