Xen XSA-528: guest-triggered use-after-free in Linux xen-blkback
Xen-blkback driver fails to serialize reads of I/O statistics allowing use-after-free during device teardown.
65
CVE-2026-100082
UAF in Linux xen-blkback reading I/O statistics
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The Linux kernel's xen-blkback has a use-after-free or NULL dereference when reading I/O statistics via sysfs concurrently with tearing down a frontend device. A guest can trigger this via sysfs. An attacker controlling a guest may cause a host kernel crash. Affects Linux systems running xen-blkback.
What to do: Apply Linux kernel update for CVE-2026-100082
| Product | Affected |
|---|---|
| Linux xen-blkback | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: xen-blkback: Avoid UAF when reading I/O statistics Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading of the statistics data is not synchronized with freeing the data. Use a rwlock for synchronizing. This is XSA-528 / CVE-2026-100082