CVE-2021-32606

In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.)

• CWE-416

• http://www.openwall.com/lists/oss-security/2021/05/12/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/13/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/14/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/28/1Mailing List, Patch, Third Party Advisory
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2b17c400aeb44daf041627722581ade527bb3c1d
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73D53S4IZFPFQMRABMXXLW4AJK3EULDX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GI7Z7UBWBGD3ABNIL2DC7RQDCGA4UVQW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HD3NJBG25AADVGPRC63RX2JOQBMPSWK4/
• https://security.netapp.com/advisory/ntap-20210625-0001/Third Party Advisory
• https://www.openwall.com/lists/oss-security/2021/05/11/16Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/12/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/13/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/14/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/28/1Mailing List, Patch, Third Party Advisory
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2b17c400aeb44daf041627722581ade527bb3c1d
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73D53S4IZFPFQMRABMXXLW4AJK3EULDX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GI7Z7UBWBGD3ABNIL2DC7RQDCGA4UVQW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HD3NJBG25AADVGPRC63RX2JOQBMPSWK4/
• https://security.netapp.com/advisory/ntap-20210625-0001/Third Party Advisory
• https://www.openwall.com/lists/oss-security/2021/05/11/16Mailing List, Third Party Advisory

Published

May 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32600An exposure of sensitive information to an unauthorized acto…3.8
• CVE-2021-32601Rejected reason: Not used
• CVE-2021-32602An improper neutralization of input during web page generati…6.1
• CVE-2021-32603A server-side request forgery (SSRF) (CWE-918) vulnerability…6.5
• CVE-2021-32604Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 …5.4
• CVE-2021-32605zzzcms zzzphp before 2.0.4 allows remote attackers to execut…9.8
• CVE-2021-32607An issue was discovered in Smartstore (aka SmartStoreNET) th…9.8
• CVE-2021-32608An issue was discovered in Smartstore (aka SmartStoreNET) th…9.8
• CVE-2021-32609Apache Superset up to and including 1.1 does not sanitize ti…5.4
• CVE-2021-32610In Archive_Tar before 1.4.14, symlinks can refer to targets …7.1
• CVE-2021-32611A NULL pointer dereference vulnerability exists in eXcall_ap…7.5
• CVE-2021-32612The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for…8.1