CVE-2021-26708

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-667

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2021/02/05/6Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/09/2Mailing List
http://www.openwall.com/lists/oss-security/2022/01/25/14Mailing List
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.13Release Notes, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c518adafa39f37858697ac9309c6cf1805581446Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210312-0008/Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/02/04/5Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/02/05/6Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/09/2Mailing List
http://www.openwall.com/lists/oss-security/2022/01/25/14Mailing List
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.13Release Notes, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c518adafa39f37858697ac9309c6cf1805581446Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210312-0008/Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/02/04/5Mailing List, Patch, Third Party Advisory

Timeline

Published: Feb 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-267099.8D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to CVE-2021-267106.1A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript v CVE-2021-267115.3A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a fra CVE-2021-267127.5Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a r CVE-2021-267136.5A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certi CVE-2021-267149.8The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and fold CVE-2021-267159.1The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The CVE-2021-267166.1Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter.CVE-2021-267177.5An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16 CVE-2021-267185.5KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection.CVE-2021-267196.5A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin CVE-2021-267207.8avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a