Zurück zu den Sicherheitshinweisen

Linux Kernel (AWS) Vulnerability — Ubuntu Security Update (USN-8967-1)

USN-8967-1 updates the AWS-flavored Linux kernel on Ubuntu, fixing CVE-2021-28714 — the Xen network backend driver did not adequately limit queued packets when a guest stopped processing them, allowing a guest to exhaust host resources. Update and reboot: sudo apt update && sudo apt upgrade linux-aws, then restart the instance.

High 6.5 CVSS
Ubuntu 20.04 Ubuntu 22.04

Was das unter einer SharedLicense-Lizenz bedeutet

Xen backend queue exhaustion is a guest-to-host denial of service: one misbehaving VM degrades or halts every other workload on the same virtualization host.

  1. Ubuntu Security Notices

  2. USN-8967-1

Publication date

3 November 2026

Overview

A security issue was fixed in the Linux kernel.

Releases


16.04 LTS

Packages

  • linux-aws – Linux kernel for Amazon Web Services (AWS) systems

Details

Jürgen Groß discovered that the Xen network backend driver in the Linux
kernel did not adequately limit the amount of queued packets when a guest
did not process them. An attacker in a guest VM can use this to cause a
denial of service (excessive kernel memory consumption) in the network
backend domain.

Jürgen Groß discovered that the Xen network backend driver in the Linux
kernel did not adequately limit the amount of queued packets when a guest
did not process them. An attacker in a guest VM can use this to cause a
denial of service (excessive kernel memory consumption) in the network
backend domain.

Update instructions

After a standard system update you need to reboot your computer to make
all the necessary changes.

Learn more about how to get the fixes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
16.04

LTS xenial

 linux-image-4.4.0-1199-aws – 

4.4.0-1199.214

Ubuntu Pro
Fix available with Ubuntu Pro via Legacy Support add-on.
linux-image-aws – 

4.4.0.1199.203

Ubuntu Pro
Fix available with Ubuntu Pro via Legacy Support add-on.

References

Related notices

Have additional questions?

Talk to a member of the team ›

Häufig gestellte Fragen

What is CVE-2021-28714?
It is a flaw in the Xen network backend driver: queued packets from a guest were not adequately limited, so a guest that stops processing its network queue can exhaust host resources — a denial-of-service from inside a VM against the whole node.
Who is affected?
Ubuntu AWS instances running the linux-aws kernel — the multi-tenant cloud context is exactly where the guest-to-host DoS matters most.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade linux-aws and restart the instance so it boots the patched kernel; verify with uname -r showing the updated AWS build.
Why is a 2021-year CVE arriving now?
Ubuntu backports fixes to its AWS kernel branch on its own schedule — the CVE is old, the complete backport is new. The practical rule stays the same: be current with the newest kernel notice for your flavor.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen