Xen details guest-triggered Linux backend driver flaws
November 10: Xen published XSA-531 (CVE-2026-99286), a statistics-read use-after-free, and XSA-532 (CVE-2026-99287), a double unmap during frontend setup. No fixes or attacks are stated.
Xen has published five guest-triggered Linux xen-netback and xen-blkback advisories, with no fixes or exploitation stated.
The Xen security team has issued five advisories for bugs in Linux backend drivers that a guest can trigger. On November 6 it published three use-after-free issues: XSA-526 (CVE-2026-100080) in xen-netback statistics handling after failed frontend connections, XSA-527 (CVE-2026-100081) in a multicast lookup that can race device teardown, and XSA-528 (CVE-2026-100082) in xen-blkback I/O-statistic reads, which most likely crashes the driver. On November 10 it added XSA-531 (CVE-2026-99286), another xen-netback statistics use-after-free when queues are freed without RCU synchronization, and XSA-532 (CVE-2026-99287), a double unmap of connection resources after illegal ring indexes. The reports do not state fixed versions or confirmed exploitation.
- XSA-526, CVE-2026-100080: xen-netback statistics use-after-free after connection errors.
- XSA-527, CVE-2026-100081: multicast lookup can read freed data during teardown.
- XSA-528, CVE-2026-100082: xen-blkback statistic reads are not serialized with free.
- XSA-531, CVE-2026-99286: failed frontend setup frees statistics without RCU sync.
- XSA-532, CVE-2026-99287: illegal ring indexes cause a double unmap.
- Reports state no fixed versions and no confirmed exploitation.
Timeline
dated events in the reporting · oldest first- Nov 6, 2026Xen publishes XSA-526 for xen-netback statistics use-after-free. · oss-security
- Nov 6, 2026Xen publishes XSA-527 for multicast-data use-after-free. · oss-security
- Nov 6, 2026Xen publishes XSA-528 for xen-blkback statistics use-after-free. · oss-security
- Nov 10, 2026Xen publishes XSA-531 for missing RCU sync on free. · oss-security
- Nov 10, 2026Xen publishes XSA-532 for double unmap of ring resources. · oss-security
What each outlet adds
beyond the shared facts- oss-securityDistinguishes five XSAs, including Nov. 10 double-unmap and RCU-sync bugs.
- Vendors
- Xen
Coverage
oldest first · one row per article · UTC- · 4d ago
oss-securityFirst report
Xen Linux driver vulnerable to use-after-free in network stats
A use-after-free vulnerability in the Linux xen-netback driver can be triggered by guests during network queue teardown.
- · 4d ago
Xen XSA-527: guest-triggered use-after-free in Linux xen-netback
Xen-netback driver performs multicast lookup on transmit path that can race with device teardown.
- · 4d ago
Xen XSA-528: guest-triggered use-after-free in Linux xen-blkback
Xen-blkback driver fails to serialize reads of I/O statistics allowing use-after-free during device teardown.
- · 10h ago
Linux xen-netback use-after-free on statistics reads (CVE-2026-99286)
Missing RCU synchronization during error teardown can free queue statistics while readers still use them.
- · 10h ago
Xen guest can double-unmap memory in Linux xen-netback (CVE-2026-99287)
Illegal ring indexes during frontend setup make cleanup unmap connection resources twice; no fix or attacks are stated.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-100081+2 related CVEs | Use-after-free in Linux xen-netback | 7.8 group max | — | ||
CVE-2026-99286+1 related CVE | Use-after-free in Linux xen-netback stats reads (XSA-531) | — | — |