CVE-2021-28660: debian debian_linux Out-of-bounds Write
Vulnerability summary
CVE-2021-28660 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 1.32% chance of exploitation in the next 30 days, higher than 70.7% of scored vulnerabilities.
Not severe (CVSS 8.8, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 28 · Related 26Timeline
- 17-03-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.32%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.32% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu48 products
- linuxAll versions (No fix recorded) | < 4.4.0-208.240 | < 4.15.0-144.148 | < 5.4.0-73.82
- linux-aws< 4.4.0-1090.94 | < 4.4.0-1126.140 | < 4.15.0-1103.110 | < 5.4.0-1048.50
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-5.4< 5.4.0-1048.50~18.04.1
Debian2 products
- linux< 5.10.24-1
- debian_linuxEOL9.0
Fedoraproject1 product
- fedoraEOL33
Linux1 product
- linux_kernel≥ 3.12, < 4.4.262 | ≥ 4.5, < 4.9.262 | ≥ 4.10, < 4.14.226 | ≥ 4.15, < 4.19.181 | ≥ 4.20, < 5.4.106 | ≥ 5.5, < 5.10.24 | ≥ 5.11, < 5.11.7
5 vendors · 61 products
References
15 links- lists.fedoraproject.org/archives/…Vendor Advisory
- security.netapp.com/advisory/ntap-20210507-0008/Third Party Advisory
