CVE-2021-38160
kernel: data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c
Severity
UnknownRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 3, 2021
Updated · June 28, 2026
Description
This CVE is being DISPUTED (*) by Red Hat with a note that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior.
(*) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38160
Statement
Red Hat Product Security does not consider this to be a vulnerability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N
CWE-1284 · Improper Validation of Specified Quantity in Input