Linux xen-netback use-after-free on statistics reads (CVE-2026-99286)
Missing RCU synchronization during error teardown can free queue statistics while readers still use them.
58
CVE-2026-99286
Use-after-free in Linux xen-netback stats reads (XSA-531)
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A cleanup race in the Linux kernel Xen netback driver can leave vif->num_queues published after queues are invalid. A Xen guest that causes a XenBus connection failure can trigger a use-after-free when the host reads network or ethtool statistics. Hosts running xen-netback are affected; Linux has not listed affected builds.
What to do: Apply the Linux kernel update that includes the XSA-531 xen-netback cleanup fix for CVE-2026-99286. No workaround is named.
| Product | Affected |
|---|---|
| Linux kernel (xen-netback) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues under rcu_read_lock. We need to unpublish vif->num_queues before synchronize_net to ensure that readers that come afterwards will not read a non-zero vif->num_queues and attempt to access invalid queues. This is the same cleanup algorithm as used in backend_disconnect and added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect"). This is XSA-531