CVE-2021-45469

In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry.

• CWE-125

• http://www.openwall.com/lists/oss-security/2021/12/25/1Mailing List, Third Party Advisory
• https://bugzilla.kernel.org/show_bug.cgi?id=215235Exploit, Issue Tracking, Patch, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git/commit/?h=dev&id=5598b24efaf4892741c798b425d543e4bed357a1Exploit, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AK2C4A43BZSWATZWFUHHHUQF3HPIALNP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QG7XV2WXKMSMKIQKIBG5LW3Y3GXEWG5Q/
• https://security.netapp.com/advisory/ntap-20220114-0003/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5050Third Party Advisory
• https://www.debian.org/security/2022/dsa-5096Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/12/25/1Mailing List, Third Party Advisory
• https://bugzilla.kernel.org/show_bug.cgi?id=215235Exploit, Issue Tracking, Patch, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git/commit/?h=dev&id=5598b24efaf4892741c798b425d543e4bed357a1Exploit, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AK2C4A43BZSWATZWFUHHHUQF3HPIALNP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QG7XV2WXKMSMKIQKIBG5LW3Y3GXEWG5Q/
• https://security.netapp.com/advisory/ntap-20220114-0003/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5050Third Party Advisory
• https://www.debian.org/security/2022/dsa-5096Third Party Advisory

Published

Dec 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-45463load_cache in GEGL before 0.4.34 allows shell expansion when…7.8
• CVE-2021-45464kvmtool through 39181fc allows an out-of-bounds write, relat…8.8
• CVE-2021-45465A vulnerability has been identified in syngo fastView (All v…7.8
• CVE-2021-45466In CWP (aka Control Web Panel or CentOS Web Panel) before 0.…9.8
• CVE-2021-45467In CWP (aka Control Web Panel or CentOS Web Panel) before 0.…9.8
• CVE-2021-45468Imperva Web Application Firewall (WAF) before 2021-12-23 all…9.8
• CVE-2021-45470lib/DatabaseLayer.py in cve-search before 4.1.0 allows regul…7.5
• CVE-2021-45471In MediaWiki through 1.37, blocked IP addresses are allowed …5.3
• CVE-2021-45472In MediaWiki through 1.37, XSS can occur in Wikibase because…6.1
• CVE-2021-45473In MediaWiki through 1.37, Wikibase item descriptions allow …6.1
• CVE-2021-45474In MediaWiki through 1.37, the Special:ImportFile URI (aka F…6.1
• CVE-2021-45475Yordam Library Information Document Automation product befor…5.3