Disclosure summary
In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8.
Source-reported weakness categories
CWE-120
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2021-28972
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| linux | linux_kernel | * {"versionStartIncluding":"5.11","versionEndExcluding":"5.11.9"} |
| fedoraproject | fedora | 32 |
| fedoraproject | fedora | 33 |
| fedoraproject | fedora | 34 |
| netapp | cloud_backup | - |
| netapp | fas/aff_baseboard_management_controller | - |
| netapp | solidfire_baseboard_management_controller_firmware | - |
Original records & references
- NIST NVD record
- CVE Program record
- git.kernel.org — Mailing List, Patch, Vendor Advisory
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.netapp.com — Third Party Advisory
- git.kernel.org — Mailing List, Patch, Vendor Advisory
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.netapp.com — Third Party Advisory
PUBLISHED 2021-03-22T13:15:15-04:00
MODIFIED 2026-10-08T17:17:34-04:00
INGESTED 2026-10-10T20:50:20-04:00