Xen guest can double-unmap memory in Linux xen-netback (CVE-2026-99287)
Original title: Xen Security Advisory 532 v1 (CVE-2026-99287) - Linux xen-netback: guest can trigger double unmap of memory
Illegal ring indexes during frontend setup make cleanup unmap connection resources twice; no fix or attacks are stated.
The Xen security team published XSA-532 for CVE-2026-99287 in Linux xen-netback. While setting up a frontend connection, the driver maps ring pages and then validates them. If ring index values are illegal, cleanup unmaps allocated connection resources twice because a test is missing. The posted snippet does not state a fix or exploitation.
Unconfirmed: The feed snippet is truncated and does not state impact beyond the double unmap, a fix, or exploitation.
- The flaw is tracked as XSA-532 and CVE-2026-99287.
- xen-netback maps ring pages, then validates their contents.
- Illegal ring index values trigger cleanup that unmaps resources twice.
- The advisory text is cut off after noting a missing test.
Impact: guest-triggered double unmap of mapped memory
| Product | Affected |
|---|---|
| Xen Linux xen-netback | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-99287 | Double unmap in Linux xen-netback from a Xen guest | — | — |
From the original article
Posted by Xen . org security team on Nov 10 Xen Security Advisory CVE-2026-99287 / XSA-532 Linux xen-netback: guest can trigger double unmap of memory ISSUE DESCRIPTION ================= When xen-netback is setting up the connection to a frontend, it is mapping the ring pages and then validating the ring pages' contents.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.