CVE-2021-28950: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-28950 is a vulnerability discovered in the Linux kernel's FUSE (filesystem-in-user-space) implementation, specifically in fs/fuse/fuse_i.h. The issue was discovered before Linux kernel version 5.11.8 and was disclosed on March 20, 2021 (Kernel Changelog, NVD).

The vulnerability occurs when a FUSE server returns invalid attributes for a file, causing a 'stall on CPU' condition because a retry loop continually finds the same bad inode. This was caused by the private implementation fuse_make_bad() failing to remove the bad inode from inode cache, resulting in the retry loop with iget5_locked() finding the same bad inode and marking it bad forever (Kernel Commit). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can result in a denial of service condition through a CPU stall. A local user permitted to run a FUSE server could exploit this vulnerability to cause a system hang or crash (Debian Advisory).

The vulnerability can be exploited by a local user who has permissions to run a FUSE server. The exploit requires low complexity and low privileges to execute (NVD).

The vulnerability was fixed in Linux kernel version 5.11.8 by modifying the fuse_make_bad() function to properly remove the bad inode from the inode cache. Various Linux distributions have released patches for their respective kernel versions, including Debian, Ubuntu, and Fedora (Debian Advisory, Fedora Update).