CVE-2021-26932 [Medium] | Security Vulnerability in Linux Kernel

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.19%	0.35%	+0.16%
2	2025-11-21	0.11%	0.19%	+0.08%
3	2025-11-18	—	0.11%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.19%

0.35%

+0.16%

2025-11-21

0.11%

0.19%

+0.08%

2025-11-18

—

0.11%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.5	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	3.6	[email protected]
1.9	2.0	LOW	`AV:L/AC:M/Au:N/C:N/I:N/A:P` Click to expand Access vector (AV:L) Requires local access to the target system. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:N) No authentication is required. Confidentiality impact (C:N) No confidentiality impact. Integrity impact (I:N) No integrity impact. Availability impact (A:P) Partial availability impact.	3.4	2.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.5

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

3.6

[email protected]

1.9

2.0

LOW

AV:L/AC:M/Au:N/C:N/I:N/A:P Click to expand

Access vector (AV:L): Requires local access to the target system.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:N): No confidentiality impact.
Integrity impact (I:N): No integrity impact.
Availability impact (A:P): Partial availability impact.

3.4

2.9

[email protected]

OS Trackers for CVE-2021-26932

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2021-26932 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2021-26932
`suse`	medium	CVE-2021-26932 severity moderate: SUSE including 531 source package names (amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, amazon/suse-sles-15-sp1-chost-byos-v20220127-hvm-ssd-x86_64, …), 937 product×package rows across 120 product lines (HPE Helion OpenStack 8, Image SLES12-SP5-Azure-BYOS, … (120 product lines)): Fixed 757, Known Affected 135, Known Not Affected 45.	https://www.suse.com/security/cve/CVE-2021-26932/
`ubuntu`	medium	CVE-2021-26932 medium priority: Ubuntu including 169 source packages (linux, linux-allwinner, …), 2180 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1695, not-affected 211, released 199, ignored 74, needed 1.	https://ubuntu.com/security/CVE-2021-26932

Affected software / configurations for CVE-2021-26932

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 3.2, <= 5.10.16	cpe:2.3:o:linux:linux_kernel::::::::
fedoraproject	fedora	32	cpe:2.3:o:fedoraproject:fedora:32:::::::*
fedoraproject	fedora	33	cpe:2.3:o:fedoraproject:fedora:33:::::::*
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*
netapp	cloud_backup	—	cpe:2.3:a:netapp:cloud_backup:-:::::::*
netapp	solidfire\,_enterprise_sds_\&_hci_storage_node	—	cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:::::::*
netapp	solidfire_\&_hci_management_node	—	cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:::::::*
netapp	hci_compute_node	—	cpe:2.3:o:netapp:hci_compute_node:-:::::::*
netapp	hci_h410c_firmware	—	cpe:2.3:o:netapp:hci_h410c_firmware:-:::::::*

References for CVE-2021-26932

URL	Tags
http://xenbits.xen.org/xsa/advisory-361.html	Patch Third Party Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ebee0eab08594b2bd5db716288a4f1ae5936e9bc
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
https://security.netapp.com/advisory/ntap-20210326-0001/	Third Party Advisory

URL

CVE-2021-26932

Exploit prediction scoring system (EPSS) score for CVE-2021-26932

Common vulnerability scoring system (CVSS) metrics for CVE-2021-26932

Weakness enumeration for CVE-2021-26932

OS Trackers for CVE-2021-26932

Affected software / configurations for CVE-2021-26932

References for CVE-2021-26932