CVE-2021-47111

What it actually does

In the Linux kernel xen-netback driver, failure to hold a reference on the RX task thread allows the thread to be freed when the frontend triggers an early return, leading to a use-after-free when kthread_stop is later invoked during backend teardown.

Why it matters to the business

Virtualized systems using Xen may experience kernel crashes, instability, or potential code execution in privileged contexts, disrupting hosted workloads and increasing risk of compromise in multi-tenant environments.

How an attack unfolds

An attacker with control of a Xen guest frontend manipulates the RX task thread to exit early before backend teardown completes; without the reference the thread object is freed, and subsequent access during kthread_stop triggers the use-after-free.

How to fix it

Upgrade affected packages to the versions that contain the fix; for fio on AlmaLinux 8 install fio-3.19-3.el8 or later. Reboot into the updated kernel after package installation.

How to confirm the fix worked

Verify the installed fio package version meets or exceeds 3.19-3.el8 on AlmaLinux 8 systems; confirm the xen-netback reference-taking logic is present in the running kernel source or binary.

Typical attack path

1. Obtain control of a Xen guest as frontend
2. Trigger early return of the RX task thread
3. Initiate backend interface teardown from dom0
4. Trigger use-after-free via kthread_stop on freed object

How to detect it

Search kernel logs for xen-netback related use-after-free oops, kthread_stop warnings, or thread-free patterns around guest interface teardown events.

What your security team should do

• Prioritize patching systems hosting Xen guests within the next maintenance window
• Monitor for kernel oops or panic logs related to xen-netback
• Review Xen guest isolation policies to limit untrusted frontends