CVE-2021-47244

Medium

Elevated severity or exploit probability.

CVSS base

8.2 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

EPSS — probability of exploitation (30 days)

0.7%

52.1th percentile

CISA KEV

Not listed

Weakness / dates

CWE-125

Published 2024-05-21 · modified 2026-08-04

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	L	Low
Integrity	N	None
Availability	H	High

Timeline

2024-05-21 — Published (NVD)
2026-08-04 — Last modified (NVD)

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix out of bounds when parsing TCP options The TCP option parser in mptcp (mptcp_get_options) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1. This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack out of bounds when parsing TCP options.").

Affected

linux

References

Official: NVD · CVE.org