CVE-2021-28714

Linux kernel: denial of service

Risk score: 59/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.3%
Published: 6 Jan 2022

Open in the live forecast Today's forecast

What to know

What it is: Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to pro…
Affected: Linux kernel
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the …

The flaws

CVE-2021-28714: Denial of service (CVSS 6.5 · EPSS 0%)
CVE-2026-98096: Out-of-bounds write (CVSS 7.4 · EPSS 1%)
CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
CVE-2026-98117: Use-after-free (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Linux kernel

Where it stands

No known exploitation

How it unfolded

3 Nov, Ubuntu security notices (official): USN-8966-1: Linux kernel vulnerabilities

Connects to

Same weakness: Denial of service (CWE-770). 258 other warnings in 30 days
Same product: Earlier Linux kernel warnings. 139 in the last 90 days

Why it is Yellow

CVSS 6.5 medium
On your watchlist: linux kernel
Named in a government or vendor bulletin

Government and vendor bulletins

USN-8966-1: Linux kernel vulnerabilities

References

Original description

Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)

Last activity 3 Nov 2026. Patch Forecast updates every hour.