Linux xen-netback use-after-free on statistics reads (CVE-2026-99286)
Original title: Xen Security Advisory 531 v1 (CVE-2026-99286) - Linux xen-netback: guest can trigger use-after-free for network statistics reads
Missing RCU synchronization during error teardown can free queue statistics while readers still use them.
XSA-531, CVE-2026-99286, affects Linux xen-netback network statistic data protected by RCU. If connecting to a frontend fails, including when a guest supplies illegal Xenstore data, queues are torn down without RCU synchronization before that memory is freed. A guest can therefore trigger a use-after-free on statistics reads. The snippet does not give a fixed version or say the bug is exploited.
Unconfirmed: The truncated advisory does not state whether the use-after-free is exploitable beyond a crash or whether a patch exists.
- The advisory is Xen Security Advisory 531 version 1.
- Statistics structures are freed after a failed frontend connection.
- Illegal Xenstore data from the guest can force that error path.
- RCU protection exists, but synchronization before free is missing.
Impact: guest-triggered use-after-free on statistics reads
| Product | Affected |
|---|---|
| Xen Linux xen-netback | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-99286 | Use-after-free in Linux xen-netback stats reads (XSA-531) | — | — |
From the original article
Posted by Xen . org security team on Nov 10 Xen Security Advisory CVE-2026-99286 / XSA-531 Linux xen-netback: guest can trigger use-after-free for network statistics reads ISSUE DESCRIPTION ================= The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.