CVE-2021-3490
Linux kernel eBPF bitwise ops ALU32 bounds tracking
- Published
- Jun 4, 2021
- Updated
- Sep 16, 2024
- Assigning CNA
- canonical
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 98.0%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
Sources
modules/exploits/linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux($.exploit_linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe.platform)
- verification: check_declared($.exploit_linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe.check)
- Linux_LPE_eBPF_CVE-2021-3490Exploit
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.