CVE-2021-3655

LowCVSS 3.3/10Last modified Oct 8, 2026

Description

A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-909 CWE-20

Affected software

Vendor	Product	Versions
n/a	kernel	kernel v5.14-rc1

References

https://bugzilla.redhat.com/show_bug.cgi?id=1984024Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.htmlMailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1984024Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.htmlMailing List, Third Party Advisory

Timeline

Published: Aug 5, 2021
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-365505.4TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulner CVE-2021-365515.4TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability a CVE-2021-36568.8A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine c CVE-2021-365609.8Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of CVE-2021-365635.4The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module. This all CVE-2021-365649.8ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Stora CVE-2021-365679.8ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.CVE-2021-365685.4In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with CVE-2021-365698.8Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.CVE-2021-36579.8A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compr CVE-2021-365708.8Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete CVE-2021-365726.1Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login