CVE-2021-28700: Debian Linux

Medium severity, CVSS 4.9. EPSS: 1.9% chance of exploitation in the next 30 days.

xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an administrator originally configured.

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Xen Xen: from 4.12.0

Published 2021-08-27. Last modified 2026-06-17.