Skip to content
OpenAdvisories
High 1 exploited CVE USN-5039-1 1 CVE

linux, linux-aws, linux-kvm, linux-lts-xenial vulnerability

Published Aug 12, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Andy Nguyen discovered that the netfilter subsystem in the Linux kernel
contained an out-of-bounds write in its setsockopt() implementation. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code.

Fixed packages 6

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS linux 3.13.0-187.238
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS linux-aws 4.4.0-1095.100
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS linux-lts-xenial 4.4.0-213.245~14.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux 4.4.0-213.245
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-aws 4.4.0-1131.145
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-kvm 4.4.0-1096.105

Vulnerabilities 1

  • High 8.3
    CVE-2021-22555 Exploited Public exploit EPSS 79%

    Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

    A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

    linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu
    KEV Oct 6, 2025

References

  • report
    https://ubuntu.com/security/CVE-2021-22555