CVE-2021-26931: Medium severity Linux Linux kernel vulnerability
An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.1.177-1Fixed in 6.12.94-1Fixed in 6.12.95-1Fixed in 7.1.3-1Fixed in 7.1.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-26931?
CVE-2021-26931 is classified as a high severity vulnerability due to its potential to cause kernel crashes.
How do I fix CVE-2021-26931?
To fix CVE-2021-26931, update your Linux kernel to version 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, or 6.12.10-1, depending on your distribution.
Which versions of the Linux kernel are affected by CVE-2021-26931?
CVE-2021-26931 affects Linux kernel versions from 2.6.39 to 5.10.16.
What systems are vulnerable to CVE-2021-26931?
Systems running certain versions of the Linux kernel, Fedora 32 and 33, and Debian 9.0 are vulnerable to CVE-2021-26931.
Is there a workaround for CVE-2021-26931?
There is no specific workaround for CVE-2021-26931, and the recommended action is to apply the available updates.