CVE-2026-100080 · Infrastructure
NO FIX YET
In the Linux kernel's xen-netback driver, network statistics can be read through sysfs after queue teardown has freed the data without waiting for RCU. This leads to reads of freed or reused memory.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Systems running the Linux kernel with the xen-netback driver, typically Xen paravirtualized guests or Xen hosts acting as network backends. The sources do not say which kernel versions are affected or whether the issue is reachable from a guest. Systems not running Xen netback can skip it.
Not affected if no-xen, xen-netback-not-loaded
Who cares linux-kernel, xen, xen-netback
Unknown from the sources.
Unknown from the sources.
In the Linux kernel, the following vulnerability has been resolved:
xen-netback: Fix UAF when reading statistics data
The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.g. due to illegal Xenstore data filled in by the guest), the statistic data is being freed without synchronizing the RCU state. In case the data is being read via sysfs in this phase, access to already freed memory or memory being in new use is possible.
Fix that by calling synchronize_net() before freeing the queue data.
This is XSA-526 / CVE-2026-100080
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.