CVE-2021-28691

HighCVSS 7.8/10Last modified Aug 26, 2026

Description

Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jun 29, 2021
Last modified
Aug 26, 2026
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-286927.1inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issCVE-2021-286935.5xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they areCVE-2021-286946.8IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corrCVE-2021-286956.8IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corrCVE-2021-286966.8IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corrCVE-2021-286977.8grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The mCVE-2021-286985.5long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domaCVE-2021-286995.5inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, wheCVE-2021-287004.9xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly frCVE-2021-287017.8Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pageCVE-2021-287027.6PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via ResCVE-2021-287037.0grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of me
CVE-2021-28691: High severity, CVSS 7.8 | Vulnix