{"id":"CVE-2026-100080","kind":"vulnerability","aliases":["CVE-2026-100080"],"related":[],"title":"Linux kernel: xen-netback use-after-free when reading network statistics","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Fix UAF when reading statistics data\n\nThe network statistic data in the driver is protected by RCU.\nUnfortunately when tearing down the queues after an error during\nconnecting to the frontend (e.g. due to illegal Xenstore data filled\nin by the guest), the statistic data is being freed without\nsynchronizing the RCU state.  In case the data is being read via sysfs\nin this phase, access to already freed memory or memory being in new\nuse is possible.\n\nFix that by calling synchronize_net() before freeing the queue data.\n\nThis is XSA-526 / CVE-2026-100080","summary":"In the Linux kernel's xen-netback driver, network statistics can be read through sysfs after queue teardown has freed the data without waiting for RCU. This leads to reads of freed or reused memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","xen","xen-netback"],"not_affected_if":["no-xen","xen-netback-not-loaded"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T19:17:03+00:00","first_seen_at":"2026-11-06T19:43:47+00:00","triaged_at":"2026-11-06T19:46:22+00:00","updated_at":"2026-11-06T19:46:22+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-06T19:46:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: xen-netback use-after-free when reading network statistics","impact":"low","summary":"In the Linux kernel's xen-netback driver, network statistics can be read through sysfs after queue teardown has freed the data without waiting for RCU. This leads to reads of freed or reused memory.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","xen","xen-netback"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown memory read through sysfs may leak or crash","analyst_note":"Check the upstream kernel commit and XSA-526 advisory for affected and fixed kernel versions and whether a guest can trigger the error path.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-xen","xen-netback-not-loaded"],"who_is_affected":"Systems running the Linux kernel with the xen-netback driver, typically Xen paravirtualized guests or Xen hosts acting as network backends. The sources do not say which kernel versions are affected or whether the issue is reachable from a guest. Systems not running Xen netback can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000671,"input_tokens":4338,"output_tokens":474,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-100080':16A,19A,172C '-2026':15A,18A,171C '-526':169C 'access':142C 'alreadi':144C 'call':158C 'case':131C 'connect':104C 'cve':14A,17A,170C 'data':50B,82C,86C,113C,121C,133C,165C 'driver':36B,89C 'due':109C 'e.g':108C 'error':102C 'fill':114C 'fix':77C,155C 'follow':69C 'free':9A,162C 'freed':48B,60B,124C,145C 'frontend':107C 'guest':118C 'illeg':111C 'infrastructur':20B 'kernel':2A,23B,31B,67C 'lead':56B 'linux':1A,22B,30B,66C 'linux-kernel':21B 'memori':63B,146C,148C 'net':160C 'netback':5A,27B,35B,76C 'network':12A,37B,84C 'new':151C 'phase':141C 'possibl':154C 'protect':91C 'queue':45B,99C,164C 'rcu':54B,93C,128C 'read':11A,41B,58B,80C,136C 'resolv':73C 'reus':62B 'state':129C 'statist':13A,38B,81C,85C,120C 'synchron':126C,159C 'sysf':43B,138C 'tear':96C 'teardown':46B 'uaf':78C 'unfortun':94C 'use':7A,152C 'use-after-fre':6A 'via':137C 'vulner':70C 'wait':52B 'without':51B,125C 'xen':4A,24B,26B,34B,75C 'xen-netback':3A,25B,33B,74C 'xenstor':112C 'xsa':168C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with the xen-netback driver, typically Xen paravirtualized guests or Xen hosts acting as network backends. The sources do not say which kernel versions are affected or whether the issue is reachable from a guest. Systems not running Xen netback can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linuxkernel","unknown","xen","xennetback"],"campaign_type":null,"search_a":"'-100080':16A,19A '-2026':15A,18A 'cve':14A,17A 'free':9A 'kernel':2A 'linux':1A 'netback':5A 'network':12A 'read':11A 'statist':13A 'use':7A 'use-after-fre':6A 'xen':4A 'xen-netback':3A","search_b":"'data':50B 'driver':36B 'freed':48B,60B 'infrastructur':20B 'kernel':23B,31B 'lead':56B 'linux':22B,30B 'linux-kernel':21B 'memori':63B 'netback':27B,35B 'network':37B 'queue':45B 'rcu':54B 'read':41B,58B 'reus':62B 'statist':38B 'sysf':43B 'teardown':46B 'wait':52B 'without':51B 'xen':24B,26B,34B 'xen-netback':25B,33B","search_c":"'-100080':172C '-2026':171C '-526':169C 'access':142C 'alreadi':144C 'call':158C 'case':131C 'connect':104C 'cve':170C 'data':82C,86C,113C,121C,133C,165C 'driver':89C 'due':109C 'e.g':108C 'error':102C 'fill':114C 'fix':77C,155C 'follow':69C 'free':162C 'freed':124C,145C 'frontend':107C 'guest':118C 'illeg':111C 'kernel':67C 'linux':66C 'memori':146C,148C 'net':160C 'netback':76C 'network':84C 'new':151C 'phase':141C 'possibl':154C 'protect':91C 'queue':99C,164C 'rcu':93C,128C 'read':80C,136C 'resolv':73C 'state':129C 'statist':81C,85C,120C 'synchron':126C,159C 'sysf':138C 'tear':96C 'uaf':78C 'unfortun':94C 'use':152C 'via':137C 'vulner':70C 'without':125C 'xen':75C 'xen-netback':74C 'xenstor':112C 'xsa':168C","first_public_at":"2026-11-06T19:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100080","severity":null,"published_at":"2026-11-06T19:17:03+00:00","modified_at":"2026-11-06T19:17:03+00:00","first_seen_at":"2026-11-06T19:43:47+00:00","fetched_at":"2026-11-06T19:43:47+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}