Skip to content
Fencer Vulns
medium 6.5

CVE-2021-28688 json

The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values.

published 2021-04-06 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-15345

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was classified to affect versions back to at least 3.11.

Patch / fix

  • linux Debian 14, Debian 13, Debian 12 5.10.28-1

debian advisories DEBIAN-CVE-2021-28688

  • linux Ubuntu 18.04 LTS 4.15.0-143.147
  • linux Ubuntu 20.04 LTS 5.4.0-74.83
  • linux-aws Ubuntu 18.04 LTS 4.15.0-1102.109
  • linux-aws Ubuntu 20.04 LTS 5.4.0-1049.51
  • linux-gcp Ubuntu 20.04 LTS 5.4.0-1044.47
  • linux-gke Ubuntu 20.04 LTS 5.4.0-1044.46
  • linux-kvm Ubuntu 18.04 LTS 4.15.0-1091.93
  • linux-kvm Ubuntu 20.04 LTS 5.4.0-1040.41

ubuntu advisories UBUNTU-CVE-2021-28688

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-syms SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +3 more 4.4.180-94.164.2
  • kernel-source SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +3 more 4.4.180-94.164.2
  • kernel-default SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 4.4.180-94.164.3
  • kgraft-patch-SLE12-SP3_Update_45 SLES for SAP 12 SP3, SLES 12 SP3-LTSS, OpenStack Cloud Crowbar 8 +2 more 1-4.3.2
  • kernel-syms SLES 12 SP2-BCL 4.4.121-92.175.2
  • kernel-source SLES 12 SP2-BCL 4.4.121-92.175.2
  • kernel-default SLES 12 SP2-BCL 4.4.121-92.175.2
  • kernel-64kb SLE Module for Basesystem 15 SP3 5.3.18-59.5.2

suse advisories SUSE-SU-2022:2082-1SUSE-SU-2022:2077-1SUSE-SU-2022:1641-1SUSE-SU-2022:1003-1SUSE-SU-2022:0668-1SUSE-SU-2021:4052-1

  • kernel-64kb openSUSE Leap 15.3 5.3.18-59.5.2
  • kernel-syms openSUSE Leap 15.3 5.3.18-59.5.1
  • kernel-obs-qa openSUSE Leap 15.3 5.3.18-59.5.1
  • kernel-source openSUSE Leap 15.3 5.3.18-59.5.2
  • kernel-default openSUSE Leap 15.3 5.3.18-59.5.2
  • kernel-preempt openSUSE Leap 15.3 5.3.18-59.5.2
  • kernel-kvmsmall openSUSE Leap 15.3 5.3.18-59.5.2
  • kernel-zfcpdump openSUSE Leap 15.3 5.3.18-59.5.2

opensuse advisories openSUSE-SU-2021:1977-1openSUSE-SU-2021:1975-1openSUSE-SU-2021:0758-1openSUSE-SU-2021:0532-1

  • linux Arch Linux 5.11.11.arch1-1
  • linux-hardened Arch Linux 5.11.11.hardened1-1
  • linux-zen Arch Linux 5.11.11.zen1-1
  • linux-lts Arch Linux 5.10.27-1

arch linux advisories AVG-1747AVG-1748AVG-1749AVG-1750

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-28688 updated cvss 6.5

xen: Linux blkback driver may leak persistent grants (XSA 371)

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.