# CVE-2021-4037: linux: A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local u...

CVE-2021-4037 is fixed in 38 products on 1 platform, first by RHSA-2022:1988, released May 10, 2022. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2021-4037
- Priority: High
- CVSS: 8.2 (medium)
- EPSS: 0.0034
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 10, 2022

## Description

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not.  This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | bpftool RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | bpftool almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | bpftool ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel rocky 8 | 0:4.18.0-372.9.1.el8 | [RLSA-2022:1988](https://patchblox.com/security/data/fix/linux/rlsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-abi-stablelists RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-abi-stablelists almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-abi-stablelists ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-core RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-core almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-core ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-cross-headers almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-cross-headers ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-debug RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-debug almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-debug ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-debug-core RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-debug-core almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-debug-core ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-debug-devel RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-debug-devel almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-debug-devel ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-debug-modules RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-debug-modules almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-debug-modules ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-debug-modules-extra RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-debug-modules-extra almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-debug-modules-extra ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-devel RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-devel almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-devel ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-doc RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-doc almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-doc ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-headers almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-headers ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-modules RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-modules almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-modules ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-modules-extra RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-modules-extra almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-modules-extra ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-rt RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt rocky 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RLSA-2022:1975](https://patchblox.com/security/data/fix/linux/rlsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-core RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-debug RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-debug-core RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-debug-devel RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-debug-kvm RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-debug-modules RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-debug-modules-extra RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-devel RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-kvm RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-modules RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-rt-modules-extra RHEL 8 | 0:4.18.0-372.9.1.rt7.166.el8 | [RHSA-2022:1975](https://patchblox.com/security/data/fix/linux/rhsa-2022-1975.md) | May 10, 2022 |
| Linux | kernel-tools RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-tools almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-tools ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-tools-libs RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-tools-libs almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-tools-libs ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-tools-libs-devel RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-tools-libs-devel almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-tools-libs-devel ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | kernel-zfcpdump RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-zfcpdump-core RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-zfcpdump-devel RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-zfcpdump-modules RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | kernel-zfcpdump-modules-extra RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | linux Debian 11.6 (bullseye) | 5.10.149-1 | [DSA-5257-1](https://patchblox.com/security/data/fix/linux/dsa-5257-1.md) | Oct 18, 2022 |
| Linux | linux Debian 12.15 (bookworm) | 5.14.6-1 | [DEBIAN-CVE-2021-4037](https://patchblox.com/security/data/fix/linux/debian-cve-2021-4037.md) | Aug 24, 2022 |
| Linux | linux Debian 13.5 (trixie) | 5.14.6-1 | [DEBIAN-CVE-2021-4037](https://patchblox.com/security/data/fix/linux/debian-cve-2021-4037.md) | Aug 24, 2022 |
| Linux | linux Debian 14 | 5.14.6-1 | [DEBIAN-CVE-2021-4037](https://patchblox.com/security/data/fix/linux/debian-cve-2021-4037.md) | Aug 24, 2022 |
| Linux | perf RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | perf almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | perf ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |
| Linux | python3-perf RHEL 8 | 0:4.18.0-372.9.1.el8 | [RHSA-2022:1988](https://patchblox.com/security/data/fix/linux/rhsa-2022-1988.md) | May 10, 2022 |
| Linux | python3-perf almalinux 8 | 4.18.0-372.9.1.el8 | [ALSA-2022:1988](https://patchblox.com/security/data/fix/linux/alsa-2022-1988.md) | May 10, 2022 |
| Linux | python3-perf ol 8 | 0:4.18.0-372.9.1.el8 | [ELSA-2022-1988](https://patchblox.com/security/data/fix/linux/elsa-2022-1988.md) | May 17, 2022 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.