CVE-2021-28039: Linux Kernel

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has CONFIG_XEN_UNPOPULATED_ALLOC but not CONFIG_XEN_BALLOON_MEMORY_HOTPLUG.

Affected products

• Linux Linux Kernel: from 5.9.0, up to and including 5.11.3
• Netapp Cloud Backup: affected versions not specified
• Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified
• Xen Xen: affected versions not specified

Published 2021-03-05. Last modified 2026-06-17.