CVE-2021-28972: Fedoraproject Fedora

Medium severity, CVSS 6.7. EPSS: 0.8% chance of exploitation in the next 30 days.

In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8.

Affected products

• Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
• Linux Linux Kernel: before 4.4.263 (fixed in 4.4.263); after 4.5, up to and including 4.9.263; from 4.10, before 4.14.227 (fixed in 4.14.227); after 4.15, up to and including 4.19.183; from 4.20, before 5.4.108 (fixed in 5.4.108); from 5.5.0, before 5.10.26 (fixed in 5.10.26); …
• Netapp Cloud Backup: affected versions not specified
• Netapp Fas/aff Baseboard Management Controller: affected versions not specified
• Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified

Published 2021-03-22. Last modified 2026-10-08.