# CVE-2021-4090: Linux Kernel NFSD out-of-bounds write in nfsd4_decode_bitmap4

Source: https://junglewise.ai/threats/cve-2021-4090-linux-kernel-nfsd-out-of-bounds-write-in-nfsd4-decode-bitmap4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-02-18. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2021-4090 · Severity: high · CVSS 7.1 · Published 2022-02-18

A security vulnerability has been identified in the Linux kernel's Network File System (NFS) server component. This flaw allows a local user with standard privileges to write data to restricted memory areas that should be inaccessible. An attacker could exploit this to compromise the integrity of the system or access sensitive information, potentially leading to a full system takeover.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem](https://junglewise.ai/threats/technologies/simatic-s7-1500-tm-mfp-gnu-linux-subsystem). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2021-4090 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-4090 being exploited in the wild.

**How severe is CVE-2021-4090?** High severity, with a CVSS score of 7.1, published 18 February 2022.

**Which products and versions are affected?** Linux Kernel Fixed in 5.16-rc2; Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.

**Is there a fix for CVE-2021-4090?** A patch was published on 2021-11-14: Upstream patch submitted by Chuck Lever Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-4090 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2021-4090?** Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds (OOB) memory write flaw was discovered in the NFSD (NFS server) implementation within the Linux kernel. The vulnerability resides in the nfsd4_decode_bitmap4 function in fs/nfsd/nfs4xdr.c, where a lack of proper input validation allows a write beyond the allocated bmval array. A local attacker with user-level privileges can trigger this overflow via specially crafted RPC requests, specifically affecting nfsd4_decode_exchange_id() calls. This can lead to the corruption of kernel memory, threatening system confidentiality and integrity. The issue was addressed by rewriting the decoding loops to ensure they do not iterate beyond the defined bitmap length.

## Affected products

- Linux Linux Kernel Fixed in 5.16-rc2
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions

## Timeline

- 2021-11-14: patched: Upstream patch submitted by Chuck Lever
- 2021-11-19: disclosed: Bug reported to Red Hat Bugzilla
- 2022-02-18: advisory: NVD publication date

## References

- [https://bugzilla.redhat.com/show_bug.cgi?id=2025101](https://bugzilla.redhat.com/show_bug.cgi?id=2025101)
- [https://lore.kernel.org/linux-nfs/163692036074.16710.5678362976688977923.stgit%40klimt.1015granger.net/](https://lore.kernel.org/linux-nfs/163692036074.16710.5678362976688977923.stgit%40klimt.1015granger.net/)
- [https://security.netapp.com/advisory/ntap-20220318-0010/](https://security.netapp.com/advisory/ntap-20220318-0010/)
- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)