CVE-2021-26932

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c.

• http://xenbits.xen.org/xsa/advisory-361.htmlPatch, Third Party Advisory
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ebee0eab08594b2bd5db716288a4f1ae5936e9bc
• https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
• https://security.netapp.com/advisory/ntap-20210326-0001/Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-361.htmlPatch, Third Party Advisory
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ebee0eab08594b2bd5db716288a4f1ae5936e9bc
• https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
• https://security.netapp.com/advisory/ntap-20210326-0001/Third Party Advisory

Published

Feb 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26926A flaw was found in jasper before 2.0.25. An out of bounds r…7.1
• CVE-2021-26927A flaw was found in jasper before 2.0.25. A null pointer der…5.5
• CVE-2021-26928BIRD through 2.0.7 does not provide functionality for passwo…6.8
• CVE-2021-26929An XSS issue was discovered in Horde Groupware Webmail Editi…6.1
• CVE-2021-26930An issue was discovered in the Linux kernel 3.11 through 5.1…7.8
• CVE-2021-26931An issue was discovered in the Linux kernel 2.6.39 through 5…5.5
• CVE-2021-26933An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a…5.5
• CVE-2021-26934An issue was discovered in the Linux kernel 4.18 through 5.1…7.8
• CVE-2021-26935In WoWonder < 3.1, remote attackers can gain access to the d…7.5
• CVE-2021-26936The replay-sorcery program in ReplaySorcery 0.4.0 through 0.…7.8
• CVE-2021-26937encoding.c in GNU Screen through 4.8.0 allows remote attacke…9.8
• CVE-2021-26938A stored XSS issue exists in henriquedornas 5.2.17 via onlin…5.4