CVE-2021-28950: Medium severity Linux Linux kernel vulnerability

Published Mar 4, 2021
·
Updated

A denial of service in the kernel side of the FUSE functionality can allow a local system to create a denial of service.

Other sources

An issue was discovered in fs/fuse/fusei.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1.

An issue was discovered in fs/fuse/fusei.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad inode.

Reference and upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed

— Red Hat

Affected Software

51 affected componentsFixes available
redhat/kernel-rt<0:4.18.0-348.rt7.130.el8
0:4.18.0-348.rt7.130.el8
redhat/kernel<0:4.18.0-348.el8
0:4.18.0-348.el8
redhat/kernel-rt<0:4.18.0-305.28.1.rt7.100.el8_4
0:4.18.0-305.28.1.rt7.100.el8_4
redhat/kernel<0:4.18.0-305.28.1.el8_4
0:4.18.0-305.28.1.el8_4
Linux Linux kernel<5.11.8
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Debian Debian Linux=9.0
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.4<5.4.0-1049.51~18.04.1
5.4.0-1049.51~18.04.1
ubuntu/linux-azure-5.4<5.4.0-1048.50~18.04.1
5.4.0-1048.50~18.04.1
ubuntu/linux-gcp-5.4<5.4.0-1044.47~18.04.2
5.4.0-1044.47~18.04.2
ubuntu/linux-gke-5.4<5.4.0-1044.46~18.04.1
5.4.0-1044.46~18.04.1
ubuntu/linux-gkeop-5.4<5.4.0-1016.17~18.04.1
5.4.0-1016.17~18.04.1
ubuntu/linux-hwe-5.4<5.4.0-74.83~18.04.1
5.4.0-74.83~18.04.1
ubuntu/linux-oracle-5.4<5.4.0-1046.50~18.04.2
5.4.0-1046.50~18.04.2
ubuntu/linux-raspi-5.4<5.4.0-1036.39~18.04.1
5.4.0-1036.39~18.04.1
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-edge*
ubuntu/linux-gke-4.15*
ubuntu/linux-hwe*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux<5.4.0-74.83
5.4.0-74.83
ubuntu/linux-aws<5.4.0-1049.51
5.4.0-1049.51
ubuntu/linux-azure<5.4.0-1048.50
5.4.0-1048.50
ubuntu/linux-bluefield<5.4.0-1012.15
5.4.0-1012.15
ubuntu/linux-gcp<5.4.0-1044.47
5.4.0-1044.47
ubuntu/linux-gke<5.4.0-1044.46
5.4.0-1044.46
ubuntu/linux-gkeop<5.4.0-1016.17
5.4.0-1016.17
ubuntu/linux-hwe-5.8<5.8.0-55.62~20.04.1
5.8.0-55.62~20.04.1
ubuntu/linux-kvm<5.4.0-1040.41
5.4.0-1040.41
ubuntu/linux-oem-5.10<5.10.0-1021.22
5.10.0-1021.22
ubuntu/linux-oracle<5.4.0-1046.50
5.4.0-1046.50
ubuntu/linux-raspi<5.4.0-1036.39
5.4.0-1036.39
ubuntu/linux-riscv-5.8<5.8.0-26.28~20.04.1
5.8.0-26.28~20.04.1
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-fips*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*
debian/linux
6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.4-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-348.rt7.130.el8
  2. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-348.el8
  3. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-305.28.1.rt7.100.el8_4
  4. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-305.28.1.el8_4
  5. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1049.51~18.04.1
  6. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1048.50~18.04.1
  7. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1044.47~18.04.2
  8. Upgrade

    Upgrade ubuntu/linux-gke-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1044.46~18.04.1
  9. Upgrade

    Upgrade ubuntu/linux-gkeop-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1016.17~18.04.1
  10. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-74.83~18.04.1
  11. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1046.50~18.04.2
  12. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1036.39~18.04.1
  13. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-74.83
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1049.51
  15. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1048.50
  16. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1012.15
  17. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1044.47
  18. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.4.0-1044.46
  19. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.4.0-1016.17
  20. Upgrade

    Upgrade ubuntu/linux-hwe-5.8 to a version that resolves this vulnerability.

    Fixed in 5.8.0-55.62~20.04.1
  21. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1040.41
  22. Upgrade

    Upgrade ubuntu/linux-oem-5.10 to a version that resolves this vulnerability.

    Fixed in 5.10.0-1021.22
  23. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1046.50
  24. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1036.39
  25. Upgrade

    Upgrade ubuntu/linux-riscv-5.8 to a version that resolves this vulnerability.

    Fixed in 5.8.0-26.28~20.04.1
  26. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1
  27. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 5.11.8
  28. Configuration

    Add `install fuse /bin/true` to `/etc/modprobe.d/disable-fuse.conf` to prevent the FUSE module from loading.

    Linux FUSE kernel module install fuse = /bin/true
  29. Operational

    Restart the system if the FUSE modules are loaded.

Event History

Mar 4, 2021
CVE Published
12:00 AM
Mar 20, 2021
CVE Published
via MITRE·07:55 PM
Data Sourced
via MITRE·07:55 PM
Description
Data Sourced
via OSV·08:15 PM
DescriptionSeverityAffected Software
Mar 22, 2021
Data Sourced
via Red Hat·06:10 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2021-28950?

CVE-2021-28950 is classified as a denial of service vulnerability in the Linux kernel.

2

How do I fix CVE-2021-28950?

To fix CVE-2021-28950, update to the latest kernel version that is above 5.11.8 or apply the relevant patches provided by your Linux distribution.

3

What impact does CVE-2021-28950 have on system performance?

CVE-2021-28950 can cause a 'stall on CPU', significantly degrading system performance and leading to a denial of service.

4

Which systems are affected by CVE-2021-28950?

CVE-2021-28950 affects various Linux distributions running kernels prior to version 5.11.8.

5

Is CVE-2021-28950 a remote or local vulnerability?

CVE-2021-28950 is a local vulnerability that requires access to the system to exploit.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203