CVE-2021-29266

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.9Release Notes, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f6bbf0010ba004f5e90c7aefdebc0ee4bd3283b9Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210513-0005/Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.9Release Notes, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f6bbf0010ba004f5e90c7aefdebc0ee4bd3283b9Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210513-0005/Third Party Advisory

Timeline

Published: Mar 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-292676.1Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staf CVE-2021-292716.1remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: Locator{URL:" followed by an XSS payload. This is related to backend/app/stor CVE-2021-292726.1bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism CVE-2021-292746.1Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.CVE-2021-292797.8There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyV CVE-2021-292806.4In TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow CVE-2021-292819.8File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which CVE-2021-292947.5Null Pointer Dereference vulnerability exists in D-Link DSL-2740R UK_1.01, which could let a remove malicious user cause a denial of service CVE-2021-292957.5Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via CVE-2021-292967.5Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vul CVE-2021-292975.3Buffer Overflow in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash CVE-2021-292985.3Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and applicat