{"id":"CVE-2021-28691","aliases":["AZL-6537","DEBIAN-CVE-2021-28691","EUVD-2021-15348","GHSA-5gvc-4qph-j93r","MGASA-2021-0257","MGASA-2021-0258","UBUNTU-CVE-2021-28691","USN-5015-1","USN-5046-1","USN-5050-1"],"status":"published","title":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can...","description":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00364,"percentile":0.30701,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2021-06-13T21:32:39Z","modified":"2026-10-23T18:03:28Z","fixes":[{"ecosystem":"Azure Linux:2","package":"kernel","fixed_in":["5.10.78.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linux","fixed_in":["5.10.46-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["5.10.46-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["5.10.46-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","fixed_in":["5.11.0-1016.17~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","fixed_in":["5.8.0-1042.44~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","fixed_in":["5.11.0-1013.14~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","fixed_in":["5.8.0-1040.43~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","fixed_in":["5.11.0-1017.19~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","fixed_in":["5.8.0-1039.41"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","fixed_in":["5.11.0-34.36~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","fixed_in":["5.10.0-1038.40"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","fixed_in":["5.11.0-1016.17~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","fixed_in":["5.8.0-1038.39~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","fixed_in":["5.11.0-1017.18~20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.78.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.46-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.46-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.46-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.43-1.mga7"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:7","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.22-1.6.mga7"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:7","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13-28.mga7"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:8","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.43-1.mga8"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:8","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.22-1.6.mga8"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:8","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-1.6.mga8"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:7","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.43-1.mga7"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:8","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.43-1.mga8"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1004.5~18.04.1","4.18.0-1005.6~18.04.1","4.18.0-1006.7~18.04.1","4.18.0-1007.8~18.04.1","4.18.0-1008.9~18.04.1","4.18.0-1009.10~18.04.1","4.18.0-1011.12~18.04.1","4.18.0-1012.13~18.04.1","4.18.0-1013.14~18.04.1","4.18.0-1015.16~18.04.1","5.0.0-1011.11~18.04.1","5.0.0-1013.13~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.0-1016.17~20.04.1"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-1042.44~20.04.1"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.0-1013.14~20.04.1"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-1040.43~20.04.1"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.0-1017.19~20.04.1"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-1039.41"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.0-34.36~20.04.1"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-1038.40"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.0-1016.17~20.04.1"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-1038.39~20.04.1"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.0-1017.18~20.04.1"}]}],"versions":["5.11.0-1015.16~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-1038.40"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.0-27.29~20.04.1"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-1042.44~20.04.1"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-1040.43~20.04.1"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-1039.41"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-1038.39~20.04.1"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1"],"bundled":6}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"h300e_firmware"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410c_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500e_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700e_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"solidfire_baseboard_management_controller"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-374.txt","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202107-30","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210805-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28691","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210805-0002"},{"url":"https://github.com/advisories/GHSA-5gvc-4qph-j93r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28691","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0257.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29106","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.42","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.43","tags":["web"]},{"url":"https://xenbits.xen.org/xsa/advisory-374.html","tags":["advisory","report"]},{"url":"https://advisories.mageia.org/MGASA-2021-0258.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28691","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5015-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5046-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5050-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-0129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38208","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-28691","description":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.","status":"published","published":"2021-06-29T11:30:53Z","modified":"2024-08-03T21:47:33.196Z","updated_at":"2026-11-02T14:33:09.175141Z"}],"euvd":[{"id":"EUVD-2021-15348","description":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.","status":"published","published":"2021-06-29T11:30:53Z","modified":"2024-08-03T21:47:33Z","updated_at":"2026-11-03T03:24:46.117926Z"}],"ghsa":[{"id":"GHSA-5gvc-4qph-j93r","title":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can...","description":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.","status":"published","published":"2022-05-24T19:06:33Z","modified":"2026-08-26T18:31:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:10:59.276943Z"}],"nvd":[{"id":"CVE-2021-28691","description":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.","status":"published","published":"2021-06-29T12:15:08.543Z","modified":"2026-08-26T17:57:08.287Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:06:55.259633Z"}],"osv":[{"id":"AZL-6537","title":"CVE-2021-28691 affecting package kernel for versions less than 5.10.78.1-1","description":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.","status":"published","published":"2021-06-29T12:15:08Z","modified":"2026-04-21T04:37:35.300273Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"CVE-2021-28691","description":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.","status":"published","published":"2021-06-29T12:15:08.543Z","modified":"2026-04-16T04:42:09.877613068Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28691","description":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.","status":"published","published":"2021-06-29T12:15:08.543Z","modified":"2026-10-23T18:03:28.227644676Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"UBUNTU-CVE-2021-28691","description":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.","status":"published","published":"2021-06-29T12:15:00Z","modified":"2026-02-04T02:28:06.134016Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"MGASA-2021-0257","title":"Updated kernel packages fix security vulnerabilities","description":"This kernel update is based on upstream 5.10.43 and fixes at least the\nfollowing security issues:\n\nThe 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and\nWPA3) and Wired Equivalent Privacy (WEP) doesn't require that received\nfragments be cleared from memory after (re)connecting to a network. Under\nthe right circumstances, when another device sends fragmented frames\nencrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary\nnetwork packets and/or exfiltrate user data (CVE-2020-24586).\n\nThe 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and\nWPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments\nof a frame are encrypted under the same key. An adversary can abuse this to\ndecrypt selected fragments when another device sends fragmented frames and\nthe WEP, CCMP, or GCMP encryption key is periodically renewed\n(CVE-2020-24587).\n\nThe 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and\nWPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU\nflag in the plaintext QoS header field is authenticated. Against devices\nthat support receiving non-SSP A-MSDU frames (which is mandatory as part\nof 802.11n), an adversary can abuse this to inject arbitrary network\npackets (CVE-2020-24588).\n\nAn issue was discovered in the kernel. An Access Point (AP) forwards EAPOL\nframes to other clients even though the sender has not yet successfully\nauthenticated to the AP. This might be abused in projected Wi-Fi networks\nto launch denial-of-service attacks against connected clients and makes\nit easier to exploit other vulnerabilities in connected clients\n(CVE-2020-26139).\n\nAn issue was discovered in the kernel ath10k driver. The Wi-Fi\nimplementation does not verify the Message Integrity Check (authenticity)\nof fragmented TKIP frames. An adversary can abuse this to inject and\npossibly decrypt packets in WPA or WPA2 networks that support the TKIP\ndata-confidentiality protocol (CVE-2020-26141). \n\nAn issue was discovered in the kernel ath10k driver. The WEP, WPA, WPA2,\nand WPA3 implementations accept second (or subsequent) broadcast fragments\neven when sent in plaintext and process them as full unfragmented frames.\nAn adversary can abuse this to inject arbitrary network packets independent\nof the network configuration (CVE-2020-26145).\n\nAn issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and\nWPA3 implementations reassemble fragments even though some of them were\nsent in plaintext. This vulnerability can be abused to inject packets and/\nor exfiltrate selected fragments when another device sends fragmented\nframes and the WEP, CCMP, or GCMP data-confidentiality protocol is used\n(CVE-2020-26147).\n\nA use after free vulnerability has been found in the hci_sock_bound_ioctl()\nfunction of the Linux kernel. It can allow attackers to corrupt kernel\nheaps (kmalloc-8k to be specific) and adopt further exploitations\n(CVE-2021-3573).\n\nThere is a guest triggered use-after-free in Linux xen-netback. A malicious\nor buggy network PV frontend can force Linux netback to disable the\ninterface and terminate the receive kernel thread associated with queue 0\nin response to the frontend sending a malformed packet. Such kernel thread\ntermination will lead to a use-after-free in Linux netback when the backend\nis destroyed, as the kernel thread associated with queue 0 will have already\nexited and thus the call to kthread_stop will be performed against a stale\npointer. A malicious or buggy frontend driver can trigger a dom0 crash.\nPrivilege escalation and information leaks cannot be ruled out.\n(CVE-2021-28691 / XSA-374).\n\nThere is a null pointer dereference in llcp_sock_getname in net/nfc/\nllcp_sock.c of the Linux kernel. An unprivileged user can trigger this bug\nand cause denial of service (CVE-2021-38208).\n\nOther fixes in this update:\n- bpf: Forbid trampoline attach for functions with variable arguments\n- bpf: Add deny list of btf ids check for tracing programs\n- net/nfc/rawsock.c: fix a permission check bug\n- proc: Track /proc/$pid/attr/ opener mm_struct\n- RDS tcp loopback connection can hang\n\nFor other upstream fixes, see the referenced changelogs.\n","status":"published","published":"2021-06-13T21:32:39Z","modified":"2026-04-16T04:44:16.587783508Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"MGASA-2021-0258","title":"Updated kernel-linus packages fix security vulnerabilities","description":"This kernel-linus update is based on upstream 5.10.43 and fixes at least\nthe following security issues:\n\nThe 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and\nWPA3) and Wired Equivalent Privacy (WEP) doesn't require that received\nfragments be cleared from memory after (re)connecting to a network. Under\nthe right circumstances, when another device sends fragmented frames\nencrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary\nnetwork packets and/or exfiltrate user data (CVE-2020-24586).\n\nThe 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and\nWPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments\nof a frame are encrypted under the same key. An adversary can abuse this to\ndecrypt selected fragments when another device sends fragmented frames and\nthe WEP, CCMP, or GCMP encryption key is periodically renewed\n(CVE-2020-24587).\n\nThe 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and\nWPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU\nflag in the plaintext QoS header field is authenticated. Against devices\nthat support receiving non-SSP A-MSDU frames (which is mandatory as part\nof 802.11n), an adversary can abuse this to inject arbitrary network\npackets (CVE-2020-24588).\n\nAn issue was discovered in the kernel. An Access Point (AP) forwards EAPOL\nframes to other clients even though the sender has not yet successfully\nauthenticated to the AP. This might be abused in projected Wi-Fi networks\nto launch denial-of-service attacks against connected clients and makes\nit easier to exploit other vulnerabilities in connected clients\n(CVE-2020-26139).\n\nAn issue was discovered in the kernel ath10k driver. The Wi-Fi\nimplementation does not verify the Message Integrity Check (authenticity)\nof fragmented TKIP frames. An adversary can abuse this to inject and\npossibly decrypt packets in WPA or WPA2 networks that support the TKIP\ndata-confidentiality protocol (CVE-2020-26141). \n\nAn issue was discovered in the kernel ath10k driver. The WEP, WPA, WPA2,\nand WPA3 implementations accept second (or subsequent) broadcast fragments\neven when sent in plaintext and process them as full unfragmented frames.\nAn adversary can abuse this to inject arbitrary network packets independent\nof the network configuration (CVE-2020-26145).\n\nAn issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and\nWPA3 implementations reassemble fragments even though some of them were\nsent in plaintext. This vulnerability can be abused to inject packets and/\nor exfiltrate selected fragments when another device sends fragmented\nframes and the WEP, CCMP, or GCMP data-confidentiality protocol is used\n(CVE-2020-26147).\n\nA double-free memory corruption in the Linux kernel HCI device\ninitialization subsystem was found in the way user attach malicious HCI\nTTY Bluetooth device. A local user could use this flaw to crash the system\n(CVE-2021-3564).\n\nA use after free vulnerability has been found in the hci_sock_bound_ioctl()\nfunction of the Linux kernel. It can allow attackers to corrupt kernel\nheaps (kmalloc-8k to be specific) and adopt further exploitations\n(CVE-2021-3573).\n\nThere is a guest triggered use-after-free in Linux xen-netback. A malicious\nor buggy network PV frontend can force Linux netback to disable the\ninterface and terminate the receive kernel thread associated with queue 0\nin response to the frontend sending a malformed packet. Such kernel thread\ntermination will lead to a use-after-free in Linux netback when the backend\nis destroyed, as the kernel thread associated with queue 0 will have already\nexited and thus the call to kthread_stop will be performed against a stale\npointer. A malicious or buggy frontend driver can trigger a dom0 crash.\nPrivilege escalation and information leaks cannot be ruled out.\n(CVE-2021-28691 / XSA-374).\n\nThere is a null pointer dereference in llcp_sock_getname in net/nfc/\nllcp_sock.c of the Linux kernel. An unprivileged user can trigger this bug\nand cause denial of service (CVE-2021-38208).\n\nFor other upstream fixes, see the referenced changelogs.\n","status":"published","published":"2021-06-13T21:32:39Z","modified":"2026-04-16T04:41:16.402400207Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"USN-5015-1","title":"linux-oem-5.10 vulnerabilities","description":"It was discovered that the virtual file system implementation in the Linux\nkernel contained an unsigned to signed integer conversion error. A local\nattacker could use this to cause a denial of service (system crash) or\nexecute arbitrary code. (CVE-2021-33909)\n\nMichael Brown discovered that the Xen netback driver in the Linux kernel\ndid not properly handle malformed packets from a network PV frontend,\nleading to a use-after-free vulnerability. An attacker in a guest VM could\nuse this to cause a denial of service or possibly execute arbitrary code.\n(CVE-2021-28691)\n\nIt was discovered that the bluetooth subsystem in the Linux kernel did not\nproperly handle HCI device initialization failure, leading to a double-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2021-3564)\n\nIt was discovered that the bluetooth subsystem in the Linux kernel did not\nproperly handle HCI device detach events, leading to a use-after-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2021-3573)\n\nIt was discovered that the NFC implementation in the Linux kernel did not\nproperly handle failed connect events leading to a NULL pointer\ndereference. A local attacker could use this to cause a denial of service.\n(CVE-2021-3587)\n","status":"published","published":"2021-07-20T21:22:45Z","modified":"2026-06-03T14:04:06.689072731Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5046-1","title":"linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.11, linux-kvm, linux-oracle, linux-raspi vulnerabilities","description":"It was discovered that the bluetooth subsystem in the Linux kernel did not\nproperly perform access control. An authenticated attacker could possibly\nuse this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)\n\nMichael Brown discovered that the Xen netback driver in the Linux kernel\ndid not properly handle malformed packets from a network PV frontend,\nleading to a use-after-free vulnerability. An attacker in a guest VM could\nuse this to cause a denial of service or possibly execute arbitrary code.\n(CVE-2021-28691)\n\nIt was discovered that the bluetooth subsystem in the Linux kernel did not\nproperly handle HCI device initialization failure, leading to a double-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2021-3564)\n\nIt was discovered that the bluetooth subsystem in the Linux kernel did not\nproperly handle HCI device detach events, leading to a use-after-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2021-3573)\n\nIt was discovered that the NFC implementation in the Linux kernel did not\nproperly handle failed connect events leading to a NULL pointer\ndereference. A local attacker could use this to cause a denial of service.\n(CVE-2021-3587)\n","status":"published","published":"2021-08-18T17:29:24Z","modified":"2026-06-03T14:04:03.748455436Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5050-1","title":"linux-aws-5.8, linux-azure-5.8, linux-gcp-5.8, linux-oracle-5.8 vulnerabilities","description":"It was discovered that the bluetooth subsystem in the Linux kernel did not\nproperly perform access control. An authenticated attacker could possibly\nuse this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)\n\nMichael Brown discovered that the Xen netback driver in the Linux kernel\ndid not properly handle malformed packets from a network PV frontend,\nleading to a use-after-free vulnerability. An attacker in a guest VM could\nuse this to cause a denial of service or possibly execute arbitrary code.\n(CVE-2021-28691)\n\nIt was discovered that the bluetooth subsystem in the Linux kernel did not\nproperly handle HCI device initialization failure, leading to a double-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2021-3564)\n\nIt was discovered that the bluetooth subsystem in the Linux kernel did not\nproperly handle HCI device detach events, leading to a use-after-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2021-3573)\n\nIt was discovered that the NFC implementation in the Linux kernel did not\nproperly handle failed connect events leading to a NULL pointer\ndereference. A local attacker could use this to cause a denial of service.\n(CVE-2021-38208)\n","status":"published","published":"2021-08-24T06:29:56Z","modified":"2026-06-03T14:03:59.559949676Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}