CVE-2021-4197: An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• broadcom brocade fabric operating system firmwareall versions
• debian debian linux10.0
• linux linux kernel4.20 and later · before 5.4.189
• linux linux kernel5.5 and later · before 5.10.111
• linux linux kernel5.11 and later · before 5.15.14
• linux linux kernel4.2 and later · before 4.14.276
• linux linux kernel4.15 and later · before 4.19.238
• netapp h300s firmwareall versions
• netapp h410c firmwareall versions
• netapp h410s firmwareall versions
• netapp h500s firmwareall versions
• netapp h700s firmwareall versions
• oracle communications cloud native core binding support function22.1.1
• oracle communications cloud native core binding support function22.1.3
• oracle communications cloud native core binding support function22.2.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• n/a kernel

  • Linux kernel 5.17-rc1affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2021-4149Mar 23, 2022 · A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs.
  22Monitor
• ← EarlierCVE-2021-4150Mar 23, 2022 · A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel.
  22Monitor
• Later →CVE-2022-0854Mar 23, 2022 · A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
  22Monitor

Root cause

Authentication is added route by route instead of being enforced in one place. When a route added later bypasses the shared middleware, the session check never runs for it.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use("/admin", requireSession, adminRouter);2
3// Route added later skips the middleware4app.post("/admin-api/config", updateConfig);

1const admin = express.Router();2admin.use(requireSession, requireRole("admin"));3
4admin.post("/config", updateConfig);5app.use("/admin", admin);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.