Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Xen discloses use-after-free flaws in netback and blkback drivers (XSA-527, XSA-528)

1 source · 2 articlesFirst reported Updated ()3
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Xen discloses two guest-triggered use-after-free vulnerabilities in netback and blkback drivers.

Xen Security Advisory XSA-527 (CVE-2026-100081) affects the xen-netback driver, where a multicast lookup on the transmit path can race with device teardown, leading to a use-after-free when reading multicast data. Xen Security Advisory XSA-528 (CVE-2026-100082) states that the xen-blkback driver fails to serialize reads of I/O statistics against freeing the memory, causing a use-after-free during device teardown that may crash the driver. Both issues are guest-triggered and affect the Linux kernel's Xen backends. No patches or exploitation status have been reported.

Key facts
  • XSA-527, CVE-2026-100081: use-after-free in xen-netback multicast lookup
  • XSA-528, CVE-2026-100082: use-after-free in xen-blkback I/O statistics reads
  • Race condition during device teardown
  • Guest-triggered vulnerability
  • No patches or exploitation status reported
  • Disclosed on oss-security November 6, 2026
Analyze CVE-2026-100082 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 6, 2026Xen Security Advisory XSA-527 v1 (CVE-2026-100081) released · oss-security
  2. Nov 6, 2026Xen Security Advisory XSA-528 v1 (CVE-2026-100082) released · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityDisclosed two related use-after-free vulnerabilities in Xen backends on 2026-11-06.
CVEs
CVE-2026-100082CVE-2026-100081
Vendors
Xen
Products
Linux xen-blkbackLinux xen-netback

Coverage

oldest first · one row per article · UTC
  1. · 2d ago oss-securityFirst report

    Xen XSA-527: guest-triggered use-after-free in Linux xen-netback

    Xen-netback driver performs multicast lookup on transmit path that can race with device teardown.

  2. · 2d ago oss-security

    Xen XSA-528: guest-triggered use-after-free in Linux xen-blkback

    Xen-blkback driver fails to serialize reads of I/O statistics allowing use-after-free during device teardown.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-100081
+1 related CVE
CVE-2026-100082
Use-after-free in Linux xen-netback
——