CVE-2021-3506

An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.

• CWE-125
• CWE-125

• http://www.openwall.com/lists/oss-security/2021/05/08/1Mailing List, Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1944298Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/06/msg00019.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210611-0007/Third Party Advisory
• https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg2520013.html
• https://www.openwall.com/lists/oss-security/2021/03/28/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/08/1Mailing List, Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1944298Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/06/msg00019.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210611-0007/Third Party Advisory
• https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg2520013.html
• https://www.openwall.com/lists/oss-security/2021/03/28/2Mailing List, Patch, Third Party Advisory

Published

Apr 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35052A component in Kaspersky Password Manager could allow an att…7.8
• CVE-2021-35053Possible system denial of service in case of arbitrary chang…7.5
• CVE-2021-35054Minecraft before 1.17.1, when online-mode=false is configure…7.5
• CVE-2021-35055MediaTek microchips, as used in NETGEAR devices through 2021…8.8
• CVE-2021-35056Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0…6.7
• CVE-2021-35059OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way…6.1
• CVE-2021-35060/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allo…5.3
• CVE-2021-35061Multiple cross-site scripting (XSS) vulnerabilities in DRK O…6.1
• CVE-2021-35062A Shell Metacharacter Injection vulnerability in result.php …8.1
• CVE-2021-35063Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical e…7.5
• CVE-2021-35064KramerAV VIAWare, all tested versions, allow privilege escal…9.8
• CVE-2021-35065The glob-parent package before 6.0.1 for Node.js allows ReDo…7.5