Xen XSA-527: guest-triggered use-after-free in Linux xen-netback
Original title: Xen Security Advisory 527 v1 (CVE-2026-100081) - Linux xen-netback: guest can trigger use-after-free for reading multicast data
Xen-netback driver performs multicast lookup on transmit path that can race with device teardown.
Multicast handling in the xen-netback driver is implemented as a lookup early on the transmit (guest receive) path. The respective function can be invoked in parallel with teardown of a device. Thus the lookup may access data which was already freed. This leads to a use-after-free when reading multicast data.
Unconfirmed: No public exploitation reported
- Xen Security Advisory XSA-527
- CVE-2026-100081
- use-after-free in xen-netback
- guest-triggered
- multicast data
Impact: use-after-free crash of driver
| Product | Affected |
|---|---|
| Xen Linux xen-netback | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100081 | Use-after-free in Linux xen-netback | — | — |
From the original article
Posted by Xen . org security team on Nov 06 Xen Security Advisory CVE-2026-100081 / XSA-527 Linux xen-netback: guest can trigger use-after-free for reading multicast data ISSUE DESCRIPTION ================= Multicast handling in the driver is implemented as a lookup early on the transmit (guest receive) path. The respective function can be invoked in parallel with teardown of a device.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.