PT-2021-3002 · Linux+2 · Linux Kernel+2

Jan Beulich · Published 2021-02-15 · Updated 2026-05-26 · CVE-2021-26934

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.18 through 5.10.16

Description An issue was discovered in the Linux kernel, as used by Xen, related to the backend allocation mode of the drm xen front drivers. This mode was not meant to be a supported configuration, but its support status was not stated accordingly. The issue is associated with unlimited resource allocation, which could allow an attacker to execute arbitrary code.

Recommendations For Linux kernel versions 4.18 through 5.10.16, consider disabling the backend allocation mode of the drm xen front drivers as a temporary workaround until a patch is available. Restrict access to the drm xen front drivers to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2021-1364

ALT-PU-2021-1388

ALT-PU-2021-1417

ALT-PU-2021-1424

ALT-PU-2021-1447

ALT-PU-2021-1621

ALT-PU-2021-1656

ALT-PU-2021-1739

ALT-PU-2021-1862

ALT-PU-2021-1866

ALT-PU-2021-1869

ALT-PU-2021-1870

BDU:2021-02597

CVE-2021-26934

ECHO-AB4C-2B4A-F4E1

Affected Products

Alt Linux

Debian

Linux Kernel

References · 27

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-26934 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2021-26934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26934 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-26934 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26934 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26934 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-363.html · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02597 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2021-26934 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2021-26934 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26934 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP · Vendor Advisory