CVE-2021-28038

What it actually does

The Xen PV netback driver in the Linux kernel fails to properly handle grant mapping errors and associated memory allocation failures, allowing a misbehaving networking frontend driver to trigger a host OS denial of service.

Why it matters to the business

Virtualized environments running affected kernels can experience unexpected host system outages, leading to downtime for multiple guest workloads and increased operational recovery costs.

How an attack unfolds

An attacker with control of a guest VM configures its networking frontend driver to induce grant mapping failures; the host netback driver encounters unhandled allocation errors and crashes or hangs the host kernel.

How to fix it

Upgrade the Linux kernel to the commit 2991397d23ec597405b116d96de3813420bdcbc3 or later; apply the vendor-supplied kernel package that includes the complete error handling fix for grant mapping failures.

How to confirm the fix worked

Verify the running kernel contains commit 2991397d23ec597405b116d96de3813420bdcbc3; confirm absence of the incomplete error paths described in the original grant mapping handling changes.

Typical attack path

1. Obtain or compromise a guest VM on the Xen host
2. Modify the guest networking frontend driver to trigger grant mapping errors
3. Cause repeated allocation failures in the host netback driver
4. Trigger host kernel instability or panic resulting in DoS

How to detect it

Inspect kernel logs for netback grant mapping error messages and unhandled allocation failures; correlate with guest networking activity that precedes host instability.

• netback.*grant mapping error
• xen-netback.*failed memory allocation

What your security team should do

• Apply the kernel update containing commit 2991397d23ec597405b116d96de3813420bdcbc3 as the highest priority on all Xen PV hosts
• Monitor for guest driver anomalies that could precede host impact
• Review virtualization isolation policies to limit guest driver influence on host resources