CVE-2021-43975: debian debian_linux Out-of-bounds Write
Vulnerability summary
CVE-2021-43975 is a medium (CVSS 6.7) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 46.1% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.7, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 29 · Related 21Timeline
- 17-11-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.55% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (git.kernel.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu67 products
- linux< 4.15.0-176.185 | < 5.4.0-100.113
- linux-aws< 4.15.0-1127.136 | < 5.4.0-1066.69
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13< 5.13.0-1019.21~20.04.1
Debian2 products
- linux< 5.15.5-2
- debian_linuxEOL9.0 | 10.0
Fedoraproject1 product
- fedoraEOL34 | 35
Linux1 product
- linux_kernel≤ 5.15.2
5 vendors · 79 products
References
19 links
lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlMailing ListX Refsource MLISTThird Party Advisory
