Xen Linux driver vulnerable to use-after-free in network stats
Original title: Xen Security Advisory 526 v1 (CVE-2026-100080) - Linux xen-netback: guest can trigger use-after-free for
A use-after-free vulnerability in the Linux xen-netback driver can be triggered by guests during network queue teardown.
The Xen security team issued advisory XSA-526 for CVE-2026-100080. Network statistic data in the driver is protected by RCU, but tearing down queues after connection errors from illegal Xenstore data supplied by the guest can trigger use-after-free.
- RCU protects network statistic data
- Guest-supplied illegal Xenstore data causes errors
- Affects queue teardown after frontend connection failure
Impact: guest can trigger use-after-free in xen-netback
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100080 | Use-after-free in Linux kernel xen-netback | — | — |
From the original article
Posted by Xen . org security team on Nov 06 Xen Security Advisory CVE-2026-100080 / XSA-526 Linux xen-netback: guest can trigger use-after-free for network statistics reads ISSUE DESCRIPTION ================= The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.