Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets

CVE-2026-98375 is a flaw in the Linux kernel Xen paravirtual network frontend, xen-netfront. handle_incoming_queue() copies the first RX slot from the backend, capped at RX_COPY_THRESHOLD, into the socket-buffer head and then calls eth_type_trans() without checking that at least an Ethernet header (ETH_HLEN) is present. If that first slot is shorter than ETH_HLEN and more slots follow, the guest BUG()s in __skb_pull(); if the whole packet is shorter than ETH_HLEN, eth_type_trans() reads the header past the end of the packet data. A Xen backend (typically dom0 or a driver domain) can therefore crash the Linux guest; this is not reachable by an unprivileged remote attacker on non-Xen hosts. No public proof of concept is known, the issue is not in CISA KEV, and exploitation in the wild is not reported.

Do: Install a distribution kernel that includes the xen-netfront fix from XSA-522 / CVE-2026-98375 and reboot affected guests so the new driver is loaded. Until then, treat dom0 and any Xen network driver domain as trusted, because a compromised or malicious backend can crash the guest with malformed RX packets. The supplied data names no fixed version, so match the patch to your distro advisory rather than assuming a version number.