CVE-2021-38166 Integer overflow in n/a

High 7.8 Published 7 Aug 2021 Updated 8 Oct 2026

An integer overflow in the Linux kernel BPF hash table allows out-of-bounds writes, potentially enabling code execution or privilege escalation for privileged users.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-38166?

CVE-2021-38166 is a high-severity vulnerability in Debian Debian Linux, published on 7 Aug 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.

Weakness: CWE-787, CWE-190

Which versions are affected by CVE-2021-38166?

It affects 3 products.

Products include Debian Debian Linux, Fedoraproject Fedora, Linux kernel.

How do I fix CVE-2021-38166?

Apply the vendor's patch.

Is CVE-2021-38166 being exploited?

There is no known exploitation of CVE-2021-38166 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as A-197155069, AZL-6581, DEBIAN-CVE-2021-38166, GHSA-cg35-fr7p-33m9, PUB-A-197155069, UBUNTU-CVE-2021-38166.