# CVE-2021-26932: Other in n/a

> Linux kernel Xen backend drivers mishandle batch hypercall errors in PV mode, potentially causing resource leaks or inconsistent state.

- **Severity:** Medium 5.5 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 17 Feb 2021
- **Updated:** 3 Aug 2024
- **Also known as:** DEBIAN-CVE-2021-26932, GHSA-w8vm-5jg7-3r38, UBUNTU-CVE-2021-26932

## What is CVE-2021-26932?

CVE-2021-26932 is a medium-severity vulnerability in Debian Debian Linux, published on 17 Feb 2021. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c.

## Which versions are affected by CVE-2021-26932?

It affects 8 products.


Products: Debian Debian Linux, Fedoraproject Fedora, Linux kernel, Netapp Cloud Backup, Netapp Hci Compute Node, Netapp Hci H410c Firmware, Netapp Solidfire\, Enterprise Sds \& Hci Storage Node, Netapp Solidfire \& Hci Management Node.

## How do I fix CVE-2021-26932?

Apply the vendor's patch.

## Is CVE-2021-26932 being exploited?

There is no known exploitation of CVE-2021-26932 in the wild and no public exploit code.

## Other vulnerabilities in Debian Debian Linux

- [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild)
- [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild)
- [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild)
- [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2021-26932 and fix it if it is affected.

What it is: CVE-2021-26932 is a medium-severity vulnerability in Debian Debian Linux, published on 17 Feb 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2021-26932 in the wild and no public exploit code.

Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2021-26932/ (Markdown: https://insights.sbomify.com/CVE-2021-26932/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2021-26932
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-26932
- OSV: https://osv.dev/vulnerability/CVE-2021-26932

---
From sbomify Insights: https://insights.sbomify.com/CVE-2021-26932/
Summaries are generated and may contain mistakes; the official description above is the record.