VULNERABILITY INTELLIGENCE

CVE-2021-22556

CVSS score5.3 MEDIUM

EPSS probability0.16%

CISA KEVNot currently listed

Published2022-05-03

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Description

The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond.

Weakness classification

cve-coordination@google.com: CWE-190
nvd@nist.gov: CWE-190

Primary references

cve-coordination@google.com — Issue Tracking, Patch, Third Party Advisory
cve-coordination@google.com — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory