Xen XSA-527: guest-triggered use-after-free in Linux xen-netback
Xen-netback driver performs multicast lookup on transmit path that can race with device teardown.
65
CVE-2026-100081
Use-after-free in Linux xen-netback
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A guest can trigger a use-after-free for reading multicast data in the Linux kernel's xen-netback driver. The flaw occurs when a guest forces disconnects before xenvif_mcast_addr_list_free() runs after TX/RX processing. An attacker can cause crashes or privilege escalation in the host. Xen guests running affected Linux kernels are affected.
What to do: Apply Xen update for XSA-527 to fix CVE-2026-100081.
| Product | Affected |
|---|---|
| Linux xen-netback | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()). Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect(). This is XSA-527 / CVE-2026-100081.