PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-4090 Netapp CVE debrief

CVE-2021-4090 is an out-of-bounds write in Linux NFSD’s bitmap decode path. A local user with low privileges may be able to write past the end of a bitmap buffer, which can threaten kernel memory integrity and confidentiality. NVD also maps the issue to several NetApp H-series firmware CPEs, so both Linux kernel and affected appliance inventories should be checked.

Vendor
Netapp
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2022-02-18
Original CVE updated
2026-08-25
Advisory published
2022-02-18
Advisory updated
2026-08-25

Who should care

Linux administrators running NFS server workloads, security teams responsible for kernel patching, and NetApp H-series appliance owners should prioritize this CVE. It is especially relevant where untrusted local users, shared hosts, or multi-tenant workloads increase the value of a local kernel memory corruption flaw.

Technical summary

NVD describes the flaw in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c, where missing sanity checks can allow a write beyond bmval[bmlen-1]. The issue is classified as CWE-787 and has CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating local exploitation requiring low privileges, with high confidentiality and integrity impact but no direct availability impact.

Defensive priority

High. This is a locally reachable kernel memory corruption issue in an NFS server code path, so patching should be prioritized on systems that run affected Linux kernels or matching NetApp firmware. Because the impact is on core memory integrity and confidentiality, remediation should be treated as urgent where local login access is not tightly controlled.

Recommended defensive actions

  • Apply the vendor-fixed Linux kernel update; NVD marks Linux kernel versions before 5.16 as affected.
  • Review NetApp guidance for the H300s, H500s, H700s, H300e, H500e, H700e, H410s, and H410c firmware CPEs listed by NVD.
  • Use asset inventory to confirm whether any deployed kernels or firmware match the affected CPEs before and after patching.
  • Limit unnecessary local user access on systems that expose NFS server functionality.
  • Track the Red Hat and Linux NFS references for patch context and vendor-specific remediation guidance.
  • Validate remediation against vendor advisories rather than relying only on broad product-family matching.

Evidence notes

The CVE record was published on 2022-02-18 and last modified on 2026-05-12. NVD cites CWE-787 and includes references to a Red Hat Bugzilla issue, a Linux NFS mailing list thread, a NetApp advisory, and a Siemens advisory. The NVD CPE data maps the issue to Linux kernel releases before 5.16 plus specific NetApp H-series firmware entries, so exposure should be validated against exact deployed versions and vendor-fixed builds.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-4090 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-4090

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-4090 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-4090

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.