CVE-2021-3640

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

VendorProductVersions
n/akernelAffects kernel v5.15.3 and prior, Fixed in v5.16-rc1 and above.

References

Timeline

Published
Mar 3, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-364005.3In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.CVE-2021-364014.8In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.CVE-2021-364025.3In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.CVE-2021-364035.3In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which mayCVE-2021-364085.5An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265.CVE-2021-364097.8There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attackCVE-2021-36416.1Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools foCVE-2021-364105.5A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback when running program dec265.CVE-2021-364115.5An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in function derive_boundarCVE-2021-364127.8A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows attaCVE-2021-364147.8A heab-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via media.c, which allows attackers to cause a denial of service oCVE-2021-364177.8A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box, which causes a denial of
CVE-2021-3640: High severity, CVSS 7.0 | Vulnix