{
  "cveId": "CVE-2021-29266",
  "url": "https://patchblox.com/security/cve/CVE-2021-29266",
  "summary": "CVE-2021-29266 is fixed in 11 products on 1 platform, first by ELSA-2021-9220, released May 10, 2021. It is not reported as exploited. Patch Radar priority: High.",
  "title": "kernel-uek-doc: [5.4.17-2102.201.3uek]\n- locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (Ali Saidi)  [Orabug: 32805544...",
  "description": "[5.4.17-2102.201.3uek]\n- locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (Ali Saidi)  [Orabug: 32805544]\n\n[5.4.17-2102.201.2uek]\n- md/bitmap: wait for external bitmap writes to complete during tear down (Sudhakar Panneerselvam)  [Orabug: 32764237] \n- ocfs2: fix deadlock between setattr and dio_end_io_write (Wengang Wang)  [Orabug: 32763849] \n- tcp: do not mess with cloned skbs in tcp_add_backlog() (Eric Dumazet)  [Orabug: 32760314] \n- Revert \u0027x86/vmlinux: Use INT3 instead of NOP for linker fill bytes\u0027 (John Donnelly)  [Orabug: 32576398]  {CVE-2021-3411}\n- iommu/vt-d: Fix agaw for a supported 48 bit guest address width (Saeed Mirzamohammadi)  [Orabug: 32734148] \n- LTS tag: v5.4.85 (Jack Vogel)  \n- x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled (Xiaochen Shen)  \n- x86/resctrl: Remove unused struct mbm_state::chunks_bw (James Morse)  \n- membarrier: Explicitly sync remote cores when SYNC_CORE is requested (Andy Lutomirski)  \n- Revert \u0027selftests/ftrace: check for do_sys_openat2 in user-memory test\u0027 (Kamal Mostafa)  \n- KVM: mmu: Fix SPTE encoding of MMIO generation upper half (Maciej S. Szmigiero)  \n- serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access (Alexander Sverdlin)  \n- ALSA: pcm: oss: Fix potential out-of-bounds shift (Takashi Iwai)  \n- USB: sisusbvga: Make console support depend on BROKEN (Thomas Gleixner)  \n- USB: UAS: introduce a quirk to set no_write_same (Oliver Neukum)  \n- xhci-pci: Allow host runtime PM as default for Intel Alpine Ridge LP (Hans de Goede)  \n- xhci: Give USB2 ports time to enter U3 in bus suspend (Li Jun)  \n- ALSA: usb-audio: Fix control \u0027access overflow\u0027 errors from chmap (Takashi Iwai)  \n- ALSA: usb-audio: Fix potential out-of-bounds shift (Takashi Iwai)  \n- USB: add RESET_RESUME quirk for Snapscan 1212 (Oliver Neukum)  \n- USB: dummy-hcd: Fix uninitialized array use in init() (Bui Quang Minh)  \n- ktest.pl: If size of log is too big to email, email error message (Steven Rostedt (VMware))  \n- net: stmmac: delete the eee_ctrl_timer after napi disabled (Fugang Duan)  \n- net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux (Martin Blumenstingl)  \n- net: ll_temac: Fix potential NULL dereference in temac_probe() (Zhang Changzhong)  \n- lan743x: fix for potential NULL pointer dereference with bare card (Sergej Bauer)  \n- tcp: fix cwnd-limited bug for TSO deferral where we send nothing (Neal Cardwell)  \n- tcp: select sane initial rcvq_space.space for big MSS (Eric Dumazet)  \n- net: stmmac: free tx skb buffer in stmmac_resume() (Fugang Duan)  \n- bridge: Fix a deadlock when enabling multicast snooping (Joseph Huang)  \n- enetc: Fix reporting of h/w packet counters (Claudiu Manoil)  \n- udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments (Xin Long)  \n- net: hns3: remove a misused pragma packed (Huazhong Tan)  \n- vrf: packets with lladdr src needs dst at input with orig_iif when needs strict (Stephen Suryaputra)  \n- net: bridge: vlan: fix error return code in __vlan_add() (Zhang Changzhong)  \n- mac80211: mesh: fix mesh_pathtbl_init() error path (Eric Dumazet)  \n- ipv4: fix error return code in rtm_to_fib_config() (Zhang Changzhong)  \n- ptrace: Prevent kernel-infoleak in ptrace_get_syscall_info() (Peilin Ye)  \n- LTS tag: v5.4.84 (Jack Vogel)  \n- compiler.h: fix barrier_data() on clang (Arvind Sankar)  \n- mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING (Minchan Kim)  \n- x86/apic/vector: Fix ordering in vector assignment (Thomas Gleixner)  \n- x86/membarrier: Get rid of a dubious optimization (Andy Lutomirski)  \n- x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP (Arvind Sankar)  \n- scsi: be2iscsi: Revert \u0027Fix a theoretical leak in beiscsi_create_eqs()\u0027 (Dan Carpenter)  \n- proc: use untagged_addr() for pagemap_read addresses (Miles Chen)  \n- kbuild: avoid static_assert for genksyms (Arnd Bergmann)  \n- drm/i915/display/dp: Compute the correct slice count for VDSC on DP (Manasi Navare)  \n- mmc: block: Fixup condition for CMD13 polling for RPMB requests (Bean Huo)  \n- pinctrl: amd: remove debounce filter setting in IRQ type setting (Coiby Xu)  \n- Input: i8042 - add Acer laptops to the i8042 reset list (Chris Chiu)  \n- Input: cm109 - do not stomp on control URB (Dmitry Torokhov)  \n- ktest.pl: Fix incorrect reboot for grub2bls (Libo Chen)  \n- can: m_can: m_can_dev_setup(): add support for bosch mcan version 3.3.0 (Pankaj Sharma)  \n- platform/x86: touchscreen_dmi: Add info for the Irbis TW118 tablet (Hans de Goede)  \n- platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC (Max Verevkin)  \n- platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE (Timo Witte)  \n- platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen (Hans de Goede)  \n- platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e (Hans de Goede)  \n- arm64: tegra: Disable the ACONNECT for Jetson TX2 (Jon Hunter)  \n- soc: fsl: dpio: Get the cpumask through cpumask_of(cpu) (Hao Si)  \n- spi: spi-nxp-fspi: fix fspi panic by unexpected interrupts (Ran Wang)  \n- irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend (Xu Qiang)  \n- ibmvnic: skip tx timeout reset while in resetting (Lijun Pan)  \n- interconnect: qcom: qcs404: Remove GPU and display RPM IDs (Georgi Djakov)  \n- scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE (Can Guo)  \n- ARC: stack unwinding: don\u0027t assume non-current task is sleeping (Vineet Gupta)  \n- arm64: dts: broadcom: clear the warnings caused by empty dma-ranges (Zhen Lei)  \n- powerpc: Drop -me200 addition to build flags (Michael Ellerman)  \n- iwlwifi: mvm: fix kernel panic in case of assert during CSA (Sara Sharon)  \n- iwlwifi: pcie: set LTR to avoid completion timeout (Johannes Berg)  \n- arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards. (Markus Reichl)  \n- iwlwifi: pcie: limit memory read spin time (Johannes Berg)  \n- x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S (Fangrui Song)  \n- Kbuild: do not emit debug info for assembly with LLVM_IAS=1 (Nick Desaulniers)\n\n[5.4.17-2102.201.1uek]\n- IB/mlx5: Reduce max order of memory allocated for xlt update (Praveen Kumar Kannoju)  [Orabug: 32751624] \n- netfilter: x_tables: Use correct memory barriers. (Mark Tomlinson)  [Orabug: 32709120]  {CVE-2021-29650}\n- perf/x86/intel: Fix a crash caused by zero PEBS status (Kan Liang)  [Orabug: 32669468]  {CVE-2021-28971}\n- btrfs: fix race when cloning extent buffer during rewind of an old root (Filipe Manana)  [Orabug: 32669450]  {CVE-2021-28964}\n\n[5.4.17-2102.201.0uek]\n- uek-rpm: Update SecureBoot Digicert 2021 certificates (Jack Vogel)  [Orabug: 32532663] \n- RDMA/rxe:  ipc_bench fails on SoftRoCE with shpd (Rao Shoaib)  [Orabug: 32716155] \n- vhost-vdpa: set v-\u003Econfig_ctx to NULL if eventfd_ctx_fdget() fails (Stefano Garzarella)  [Orabug: 32696005]  {CVE-2021-29266}\n- vhost-vdpa: fix use-after-free of v-\u003Econfig_ctx (Stefano Garzarella)  [Orabug: 32696005]  {CVE-2021-29266}\n- fuse: fix live lock in fuse_iget() (Amir Goldstein)  [Orabug: 32669269]  {CVE-2021-28950}\n- fuse: fix bad inode (Miklos Szeredi)  [Orabug: 32669269]  {CVE-2021-28950}\n- RDMA/core: Fix corrupted SL on passive side (Hakon Bugge)  [Orabug: 32662965] \n- Xen/gnttab: handle p2m update errors on a per-slot basis (Jan Beulich)  [Orabug: 32651473]  {CVE-2021-28038}\n- RDMA/rxe: Compute the maximum sges and inline size based on the WQE size (Rao Shoaib)  [Orabug: 32648060] \n- KVM: kvmclock: Fix vCPUs \u003E 64 can\u0027t be online/hotpluged (Wanpeng Li)  [Orabug: 32641672] \n- xen/netback: avoid race in xenvif_rx_ring_slots_available() (Juergen Gross)  [Orabug: 32640116] \n- uek-rpm: ol7: aarch64: add CONFIG_ACPI_HOTPLUG_MEMORY (Mihai Carabas)  [Orabug: 32638660] \n- KVM: SVM: Disable AVIC before setting V_IRQ (Suravee Suthikulpanit)  [Orabug: 32603569] \n- KVM: Introduce kvm_make_all_cpus_request_except() (Suravee Suthikulpanit)  [Orabug: 32603569] \n- KVM: X86: correct meaningless kvm_apicv_activated() check (Paolo Bonzini)  [Orabug: 32603569] \n- KVM: Disable preemption in kvm_get_running_vcpu() (Marc Zyngier)  [Orabug: 32603569] \n- KVM: Move running VCPU from ARM to common code (Paolo Bonzini)  [Orabug: 32603569] \n- xen-blkback: don\u0027t leak persistent grants from xen_blkbk_map() (Jan Beulich)  [Orabug: 32697850]  {CVE-2021-28688}\n- video: hyperv_fb: Fix the mmap() regression for v5.4.y and older (Dexuan Cui)  [Orabug: 32651461]",
  "published": "2021-05-10T00:00:00Z",
  "severity": "IMPORTANT",
  "cvss": 7.8,
  "epss": 0.00318,
  "epssPercentile": 0.24829,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "kernel-uek",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el8uek",
      "fix": "ELSA-2021-9220",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9220",
      "released": "2021-05-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-container",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el8",
      "fix": "ELSA-2021-9221",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9221",
      "released": "2021-06-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-container-debug",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el8",
      "fix": "ELSA-2021-9221",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9221",
      "released": "2021-06-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el8uek",
      "fix": "ELSA-2021-9220",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9220",
      "released": "2021-05-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el8uek",
      "fix": "ELSA-2021-9220",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9220",
      "released": "2021-05-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el8uek",
      "fix": "ELSA-2021-9220",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9220",
      "released": "2021-05-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-doc",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el8uek",
      "fix": "ELSA-2021-9220",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9220",
      "released": "2021-05-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-tools",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el7uek",
      "fix": "ELSA-2021-9220",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9220",
      "released": "2021-05-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-tools-libs",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el7uek",
      "fix": "ELSA-2021-9220",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9220",
      "released": "2021-05-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "perf",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el7uek",
      "fix": "ELSA-2021-9220",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9220",
      "released": "2021-05-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python-perf",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2102.201.3.el7uek",
      "fix": "ELSA-2021-9220",
      "url": "https://patchblox.com/security/fix/linux/elsa-2021-9220",
      "released": "2021-05-10T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T06:34:28Z"
}