Xen XSA-528: guest-triggered use-after-free in Linux xen-blkback
Xen-blkback driver fails to serialize reads of I/O statistics allowing use-after-free during device teardown.
65
- Mentions · 7d5
- Mentions · 30d5
- All mentions6
- First seenOct 9, 2026
- Last mentioned2d ago
Timeline
6 articles · newest firstXen XSA-527: guest-triggered use-after-free in Linux xen-netback
Xen-netback driver performs multicast lookup on transmit path that can race with device teardown.
65
Xen Linux driver vulnerable to use-after-free in network stats
A use-after-free vulnerability in the Linux xen-netback driver can be triggered by guests during network queue teardown.
60
Xen hypervisor flaws let one VM read and write any other VM memory
Xen versions 4.6+ allow a malicious guest VM to read and write memory of other VMs including dom0 via grant copy permission checks.
75
Xen XSA-523 v2 discloses arbitrary read/write via grant copy
Public release of XSA-523 v2 details batch grant copy optimizations and potential read/write issues in Xen.
70
Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets
Xen XSA-522 warns a malicious backend can crash Linux guests via malformed xen-netfront packets, CVE-2026-98375.
52
Related CVEs
by mentions- Misplaced permission check in Xen grant copy by frame number
- Frame/grant ref mixing in Xen grant copy cache
- Linux xen-netfront guest crash via short RX headers
- Use-after-free in Linux kernel xen-netback
- Use-after-free in Linux xen-netback
- UAF in Linux xen-blkback reading I/O statistics
Appears with
- Linuxproduct · 2
- Linux xen-blkbackproduct · 1
- xen-netfrontproduct · 1
- Linux xen-netbackproduct · 1
- Xen Projectorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.