CVE-2021-28702: Debian Linux

High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days.

PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Xen Xen: from 4.13.0, up to and including 4.15.1

Published 2021-10-06. Last modified 2026-06-17.