7.5

CVE-2021-36222: debian debian_linux NULL Pointer Dereference

Modified
AliasesALPINE-CVE-2021-36222SUSE-SU-2021:2800-1UBUNTU-CVE-2021-36222
Published 22-07-2021Last modified 14-10-2026

Vulnerability summary

CVE-2021-36222 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 10.51% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 11% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
10.51%
0%100%
Medium · +0.23 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 14
OPENSUSE-SU-2022:0283-1OPENSUSE-SU-2024:10899-1OPENSUSE-SU-2024:11816-1RHSA-2021:3576SUSE-FU-2022:1419-1SUSE-SU-2022:0283-1

Timeline

  1. 22-07-2021
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

10.51%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

Increase +0.23 pp

From 10.28% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse14 products
  • krb5&distro=SUSE Enterprise Storage 6< 1.16.3-3.21.1
  • krb5&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 1.16.3-3.21.1
  • krb5&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.16.3-3.21.1
  • krb5&distro=SUSE Linux Enterprise Micro 5.0< 1.16.3-3.21.1
  • krb5&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 1.16.3-3.21.1
Netapp4 products
Opensuse4 products
  • krb5-mini&distro=openSUSE Leap 15.2< 1.16.3-lp152.5.19.1
  • krb5-mini&distro=openSUSE Leap 15.3< 1.16.3-3.21.1
  • krb5&distro=openSUSE Leap 15.2< 1.16.3-lp152.5.19.1
  • krb5&distro=openSUSE Leap 15.3< 1.16.3-3.21.1
Debian2 products
Alpine1 product
  • krb5< 1.18.4-r0
Mit1 product
Oracle1 product
Ubuntu1 product
  • krb5< 1.16-2ubuntu0.4 | < 1.17-6ubuntu4.3

8 vendors · 28 products

References

19 links
Show all 19 references