---
id: CVE-2021-4037
title: >-
  A vulnerability was found in the fs/inode.c:inode_init_owner() function logic
  of the LInux kernel that allows local users to create files for the XFS
  file-system with an unintended group ownership and with group execution and
  SGID permis…
summary: >-
  A vulnerability was found in the fs/inode.c:inode_init_owner() function logic
  of the LInux kernel that allows local users to create files for the XFS
  file-system with an unintended group ownership and with group execution and
  SGID permis…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-284
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 5.11
  - debian_linux = 10.0
  - debian_linux = 11.0
patched:
  - linux_kernel 5.11
published: '2022-08-24'
updated: '2026-08-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-4037'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2022:1975'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2022:1988'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2022:4829'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2022:4835'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2021-4037'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2027239'
    label: secalert@redhat.com
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
    label: secalert@redhat.com
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2021-4037'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2004810'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2027239'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2022/dsa-5257'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00314
epssPercentile: 0.24576
ingestedAt: '2026-08-11T16:47:02.445Z'
---

## Overview

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not.  This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.

## Affected

- `linux_kernel < 5.11`
- `debian_linux = 10.0`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 5.11`