CVE-2021-29266: Use After Free
An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->configctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.1.177-1Fixed in 6.12.94-1Fixed in 6.12.95-1Fixed in 7.1.3-1Fixed in 7.1.4-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.11.9Patch CID-f6bbf0010ba0
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29266?
CVE-2021-29266 is rated as a high severity vulnerability due to its use-after-free nature that can lead to potential exploitation.
How do I fix CVE-2021-29266?
To fix CVE-2021-29266, update your Linux kernel to version 5.11.9 or later, or use one of the recommended patched versions provided by your distribution.
What systems are affected by CVE-2021-29266?
CVE-2021-29266 affects Linux kernel versions prior to 5.11.9 and certain versions between 5.8 and 5.10.26.
What type of vulnerability is CVE-2021-29266?
CVE-2021-29266 is classified as a use-after-free vulnerability impacting the vhost driver in the Linux kernel.
Can CVE-2021-29266 lead to remote code execution?
Yes, CVE-2021-29266 may allow an attacker to execute arbitrary code by exploiting the use-after-free condition.