{"id":"CVE-2021-28691","title":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sen…","summary":"Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sen…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"netapp","product":"solidfire_baseboard_management_controller","affected":["solidfire_baseboard_management_controller","linux_kernel >= 5.5.0, < 5.10.43","cloud_backup","h410c_firmware","h300s_firmware","h500s_firmware","h700s_firmware","h300e_firmware","h500e_firmware","h700e_firmware","h410s_firmware"],"patched":["linux_kernel 5.10.43"],"published":"2021-06-29","updated":"2026-08-26","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-28691","references":[{"url":"https://security.gentoo.org/glsa/202107-30","label":"security@xen.org"},{"url":"https://security.netapp.com/advisory/ntap-20210805-0002/","label":"security@xen.org"},{"url":"https://xenbits.xenproject.org/xsa/advisory-374.txt","label":"security@xen.org"},{"url":"https://security.gentoo.org/glsa/202107-30","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20210805-0002/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://xenbits.xenproject.org/xsa/advisory-374.txt","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00361,"epssPercentile":0.29825,"ingestedAt":"2026-08-26T18:47:53.472Z","slug":"CVE-2021-28691","body":"## Overview\n\nGuest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.\n\n## Affected\n\n- `solidfire_baseboard_management_controller`\n- `linux_kernel >= 5.5.0, < 5.10.43`\n- `cloud_backup`\n- `h410c_firmware`\n- `h300s_firmware`\n- `h500s_firmware`\n- `h700s_firmware`\n- `h300e_firmware`\n- `h500e_firmware`\n- `h700e_firmware`\n- `h410s_firmware`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 5.10.43`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}