CVE-2021-3178

fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to prevent this attack; see also the exports(5) no_subtree_check default behavior

• CWE-22

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=51b2ee7d006a736a9126e8111d1f24e4fd0afaa6Mailing List, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SGB7TNDVQEOJ7NVTGX56UWHDNQM5TRC/
• https://patchwork.kernel.org/project/linux-nfs/patch/20210111210129.GA11652%40fieldses.org/
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=51b2ee7d006a736a9126e8111d1f24e4fd0afaa6Mailing List, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SGB7TNDVQEOJ7NVTGX56UWHDNQM5TRC/
• https://patchwork.kernel.org/project/linux-nfs/patch/20210111210129.GA11652%40fieldses.org/

Published

Jan 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3177Python 3.x through 3.9.1 has a buffer overflow in PyCArg_rep…9.8
• CVE-2021-31771Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-31776Aviatrix VPN Client before 2.14.14 on Windows has an unquote…7.8
• CVE-2021-31777The dce (aka Dynamic Content Element) extension 2.2.0 throug…4.9
• CVE-2021-31778The media2click (aka 2 Clicks for External Media) extension …5.4
• CVE-2021-31779The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYP…6.4
• CVE-2021-31780In app/Model/MispObject.php in MISP 2.4.141, an incorrect sh…7.5
• CVE-2021-31783show_default.php in the LocalFilesEditor extension before 11…7.5
• CVE-2021-31784An out-of-bounds write vulnerability exists in the file-read…7.8
• CVE-2021-31785The Bluetooth Classic implementation on Actions ATS2815 and …6.5
• CVE-2021-31786The Bluetooth Classic Audio implementation on Actions ATS281…6.5
• CVE-2021-31787The Bluetooth Classic implementation on Actions ATS2815 chip…6.5