CVE-2021-4090

An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat.

• CWE-787
• CWE-787

• https://bugzilla.redhat.com/show_bug.cgi?id=2025101Issue Tracking, Patch, Third Party Advisory
• https://lore.kernel.org/linux-nfs/163692036074.16710.5678362976688977923.stgit%40klimt.1015granger.net/
• https://security.netapp.com/advisory/ntap-20220318-0010/Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2025101Issue Tracking, Patch, Third Party Advisory
• https://lore.kernel.org/linux-nfs/163692036074.16710.5678362976688977923.stgit%40klimt.1015granger.net/
• https://security.netapp.com/advisory/ntap-20220318-0010/Third Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Published

Feb 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40894A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40895A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40896A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40897A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40898A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40899A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40900A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40901A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40902flatCore-CMS version 2.0.8 is affected by Cross Site Scripti…5.4
• CVE-2021-40903A vulnerability in Antminer Monitor 0.50.0 exists because of…9.8
• CVE-2021-40904The web management console of CheckMK Raw Edition (versions …8.8
• CVE-2021-40905The web management console of CheckMK Enterprise Edition (ve…8.8