CVE intelligence

CVE-2021-3640

Vulnerability intelligence

Published Mar 3, 2022Sources checked Nov 3, 2026

7.0HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2021-3640 and is rated High severity with a CVSS score of 7.0. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Ubuntu Security Notices guidance

Vendor revision: Nov 3, 2026

This update corrects flaws in the following subsystems: - File systems infrastructure; (CVE-2022-49058)

CISA KEVNot listedBased on the latest collected catalog

EPSS0.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2021-3640?

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

Source: NVD