What is CVE-2021-3492?

CVE-2021-3492 is a high-severity vulnerability in Canonical Ubuntu Linux, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 8.8/10. Published 2021-04-17.

How severe is CVE-2021-3492?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2021-3492 known to be exploited?

31 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Double Free in Canonical Ubuntu Linux

CVE-2021-3492

Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562.

Published 2021-04-17 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.015 (74.5th percentile), scored 2026-10-21.

Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 74.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000

Affected products

Canonical Ubuntu Linux
Ubuntu Linux Kernel — versions 5.8 kernel, 5.4 kernel

Weakness classification (CWE)

Public proof-of-concept exploits

References

www.openwall.com/lists/oss-security/2021/04/16/2 (Mailing List, Third Party Advisory)
git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/ (Patch, Mailing List, Vendor Advisory)
git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/ (Patch, Mailing List, Vendor Advisory)
ubuntu.com/security/notices/USN-4917-1 (Vendor Advisory)
www.zerodayinitiative.com/advisories/ZDI-21-422/ (VDB Entry, Third Party Advisory)
packetstormsecurity.com/files/162614/Kernel-Live-Patch-Security-Notice-LSN-0077… (VDB Entry, Third Party Advisory)

Frequently asked questions

What is CVE-2021-3492?: CVE-2021-3492 is a high-severity vulnerability in Canonical Ubuntu Linux, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 8.8/10. Published 2021-04-17.
How severe is CVE-2021-3492?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2021-3492 known to be exploited?: 31 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.