Xen XSA-528: guest-triggered use-after-free in Linux xen-blkback
Original title: Xen Security Advisory 528 v1 (CVE-2026-100082) - Linux xen-blkback: guest can trigger use-after-free for reading statistic data
Xen-blkback driver fails to serialize reads of I/O statistics allowing use-after-free during device teardown.
The xen-blkback driver does not serialize reads of device I/O statistics against freeing of the memory holding them. This leads to a use-after-free when reading statistical counters while the device is being torn down. The issue most likely crashes the driver.
Unconfirmed: No public exploitation reported
- Xen Security Advisory XSA-528
- CVE-2026-100082
- use-after-free in xen-blkback
- guest-triggered
- device teardown
Impact: use-after-free crash of driver
| Product | Affected |
|---|---|
| Xen Linux xen-blkback | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100082 | UAF in Linux xen-blkback reading I/O statistics | — | — |
From the original article
Posted by Xen . org security team on Nov 06 Xen Security Advisory CVE-2026-100082 / XSA-528 Linux xen-blkback: guest can trigger use-after-free for reading statistic data ISSUE DESCRIPTION ================= he driver does not serialise reads of the device I/O statistics against the freeing of the memory that holds them.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.