# CVE-2021-3929: qemu: A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU CVE-2021-3929 is fixed in 20 products on 1 platform, first by qemu 1:6.2+dfsg-2ubuntu6.2, released April 29, 2022. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2021-3929 - Priority: High - CVSS: 8.2 (high) - EPSS: 0.0068 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Dec 23, 2021 ## Description A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | qemu Debian 12.15 (bookworm) | 1:7.0+dfsg-1 | [DEBIAN-CVE-2021-3929](https://patchblox.com/security/data/fix/linux/debian-cve-2021-3929.md) | Aug 25, 2022 | | Linux | qemu Debian 13.5 (trixie) | 1:7.0+dfsg-1 | [DEBIAN-CVE-2021-3929](https://patchblox.com/security/data/fix/linux/debian-cve-2021-3929.md) | Aug 25, 2022 | | Linux | qemu Debian 14 | 1:7.0+dfsg-1 | [DEBIAN-CVE-2021-3929](https://patchblox.com/security/data/fix/linux/debian-cve-2021-3929.md) | Aug 25, 2022 | | Linux | qemu Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-block-extra Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-block-extra 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-block-extra-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-guest-agent Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-guest-agent 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-guest-agent-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-arm Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-arm 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-arm-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-common Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-common 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-common-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-data Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-data 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-data-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-gui Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-gui 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-gui-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-mips Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-mips 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-mips-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-misc Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-misc 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-misc-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-ppc Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-ppc 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-ppc-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-s390x Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-s390x 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-s390x-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-sparc Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-sparc 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-sparc-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-x86 Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-x86 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-x86-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-x86-microvm Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-x86-microvm 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-x86-microvm-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-system-x86-xen Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-system-x86-xen 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-system-x86-xen-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-user Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-user 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-user-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-user-binfmt Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-user-binfmt 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-user-binfmt-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-user-static Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-user-static 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-user-static-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | | Linux | qemu-utils Ubuntu 22.04.1 LTS (jammy) | 1:6.2+dfsg-2ubuntu6.2 | [qemu-utils 1:6.2+dfsg-2ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-utils-1-6.2-dfsg-2ubuntu6.2.md) | Apr 29, 2022 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.