CVE-2021-31440

HIGH

Linux Kernel 5.11.15 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2021-31440. PoCs published by hhhell, WhatsWrongAndWhy.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-31440, a Linux kernel eBPF verifier integer signedness bug that allows local privilege escalation (LPE). The exploit leverages a boundary check bypass in the eBPF verifier to achieve arbitrary kernel memory read/write and ultimately gain root privileges.

Description

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-13661.

Exploits (2)

github WORKING POC
by hhhell · cpoc
https://github.com/hhhell/CVE-Vulnerability-Reproduction/tree/master/CVE-2021-31440

This repository contains a functional exploit for CVE-2021-31440, a Linux kernel eBPF verifier integer signedness bug that allows local privilege escalation (LPE). The exploit leverages a boundary check bypass in the eBPF verifier to achieve arbitrary kernel memory read/write and ultimately gain root privileges.

Classification
Working Poc 98%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel versions 5.7 - 5.12.3
Auth required
Prerequisites: Local user access on a vulnerable Linux kernel · eBPF functionality enabled (unprivileged_bpf_disabled not set to 1) · Ability to compile and execute C code
mistral-large-3 · analyzed Jul 28, 2026 Full analysis →
nomisec TROJAN
by WhatsWrongAndWhy · poc
https://github.com/WhatsWrongAndWhy/CVE-2021-31440

The file labeled as 'CVE-2021-31440' is an ELF binary, not human-readable exploit code. The binary contains obfuscated segments, syscalls, and shellcode-like sequences that do not align with the expected technical details of CVE-2021-31440 (a Linux kernel eBPF verifier flaw). The binary appears to be a malicious payload unrelated to the stated CVE.

Classification
Trojan 99%
Attack Type
Other
Complexity
Complex
Reliability
Reliable
Target: unknown (binary does not target eBPF or Linux kernel explicitly)
No auth needed
mistral-large-3 · analyzed Jul 22, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 7.0
EPSS 0.0175
EPSS Percentile 75.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-682
Status published
Products (10)
linux/linux_kernel 5.7 - 5.10.37
netapp/cloud_backup
netapp/h300e_firmware
netapp/h300s_firmware
netapp/h410s_firmware
netapp/h500e_firmware
netapp/h500s_firmware
netapp/h700e_firmware
netapp/h700s_firmware
netapp/solidfire_baseboard_management_controller_firmware
Published May 21, 2021
Tracked Since Feb 18, 2026