A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
{
"unresolved_ranges": [
{
"extracted_events": [
{
"last_affected": "21.10"
}
],
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "10.0"
},
{
"last_affected": "11.0"
}
],
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "35"
}
],
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.0"
}
],
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.6"
}
],
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_eus",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.0"
}
],
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_for_ibm_z_systems",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.6"
}
],
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_for_ibm_z_systems_eus",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.0"
}
],
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_for_power_little_endian",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.6"
}
],
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_for_power_little_endian_eus",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.6"
}
],
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.6"
}
],
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_tus",
"source": "CPE_FIELD"
}
]
}{
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "7.1.0"
}
],
"cpe": "cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*",
"source": [
"CPE_FIELD",
"REFERENCES"
]
}[
{
"id": "CVE-2021-3975-12a0a0d2",
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "src/qemu/qemu_process.c"
},
"deprecated": false,
"source": "https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315265246104295043233028789217389565548",
"105764427624893722313441396925088733050",
"286241987283172516990844761613712295006",
"197158705559895140885010290749044057343"
]
}
},
{
"id": "CVE-2021-3975-57583cdb",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"function": "qemuProcessHandleMonitorEOF",
"file": "src/qemu/qemu_process.c"
},
"deprecated": false,
"source": "https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7",
"digest": {
"function_hash": "230318565073693938830034361256505555002",
"length": 654.0
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-3975.json"
"2026-05-19T00:39:29Z"