CVE-2021-3739

HighCVSS 7.1/10Last modified Sep 1, 2026

Description

A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’. This flaw allows a local attacker to crash the system or leak kernel internal information. The highest threat from this vulnerability is to system availability.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	kernel	Fixed in v5.15-rc1 and above.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1997958Issue Tracking, Patch, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e4571b8c5e9ffa1e85c0c671995bd4dcc5c75091Mailing List, Patch, Vendor Advisory
https://github.com/torvalds/linux/commit/e4571b8c5e9ffa1e85c0c671995bd4dcc5c75091Exploit, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20220407-0006/Third Party Advisory
https://ubuntu.com/security/CVE-2021-3739Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/08/25/3Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1997958Issue Tracking, Patch, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e4571b8c5e9ffa1e85c0c671995bd4dcc5c75091Mailing List, Patch, Vendor Advisory
https://github.com/torvalds/linux/commit/e4571b8c5e9ffa1e85c0c671995bd4dcc5c75091Exploit, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20220407-0006/Third Party Advisory
https://ubuntu.com/security/CVE-2021-3739Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/08/25/3Mailing List, Patch, Third Party Advisory

Timeline

Published: Mar 10, 2022
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-373906.1A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).CVE-2021-373915.4A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/socia CVE-2021-373925.4In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enable CVE-2021-373935.4In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password CVE-2021-373948.8In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.CVE-2021-37406.8A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions CVE-2021-374009.8An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may b CVE-2021-374019.8An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC use CVE-2021-374026.1OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval CVE-2021-374036.1OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link i CVE-2021-374049.8There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may CVE-2021-374097.8Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enabl