CVE-2021-3490: Linux kernel eBPF bitwise ops ALU32 bounds tracking
Last updated 4 July 2026
Other sources
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.1.177-1Fixed in 6.12.94-1Fixed in 6.12.95-1Fixed in 7.1.3-1Fixed in 7.1.4-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v5.13-rc4Patch 049c4e13714 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v5.12.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v5.11.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v5.10.37
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3490?
CVE-2021-3490 is considered a high severity vulnerability due to its potential for arbitrary code execution in the Linux kernel.
How do I fix CVE-2021-3490?
To mitigate CVE-2021-3490, update your Linux kernel to a version that addresses this vulnerability, such as 5.10.223-1 or later.
Which Linux kernel versions are affected by CVE-2021-3490?
CVE-2021-3490 affects Linux kernel versions between 5.10 and 5.13, including specific release candidates.
What type of vulnerability is CVE-2021-3490 classified as?
CVE-2021-3490 is classified as a memory corruption vulnerability that stems from improper bounds tracking.
Can CVE-2021-3490 be exploited remotely?
CVE-2021-3490 requires local access to the system for exploitation, making it a local privilege escalation issue.