{"id":"CVE-2026-100081","kind":"vulnerability","aliases":["CVE-2026-100081"],"related":[],"title":"Linux kernel: xen-netback multicast address list freed too early","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()'s error path doesn't require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081.","summary":"A race in the Linux kernel's Xen network backend frees the multicast address list while transmit and receive processing may still be using it. The sources do not state what an attacker gets beyond this memory-ordering problem.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","self-hosted","xen","xen-netback"],"not_affected_if":["no-xen-netback"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T19:17:03+00:00","first_seen_at":"2026-11-06T19:43:47+00:00","triaged_at":"2026-11-06T19:46:21+00:00","updated_at":"2026-11-06T19:46:21+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-06T19:46:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel: xen-netback multicast address list freed too early","impact":"medium","summary":"A race in the Linux kernel's Xen network backend frees the multicast address list while transmit and receive processing may still be using it. The sources do not state what an attacker gets beyond this memory-ordering problem.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","xen","xen-netback","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; sources describe only a locking and ordering race","analyst_note":"Find the kernel fix commit and affected version ranges for XSA-527 in the Xen security advisory and NVD entry.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-xen-netback"],"who_is_affected":"Systems running the Linux kernel as a Xen host with the xen-netback network backend in use, typically Xen dom0 or driver domains. The sources do not say which kernel versions are affected or whether a default configuration is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000659,"input_tokens":4358,"output_tokens":447,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-100081':14A,17A,166C '-2026':13A,16A,165C '-527':163C 'action':119C 'addr':85C 'address':7A,42B 'adds/removes':114C 'attack':61B 'avoid':95C 'backend':38B,158C 'beyond':63B 'call':120C,127C,134C 'clean':147C 'connect':139C 'cve':12A,15A,164C 'data':132C 'defer':82C 'disconnect':131C,159C 'doesn':143C 'earli':11A 'error':141C 'finished/stopped':106C 'follow':74C 'free':39B,87C 'freed':9A 'function':92C,137C 'get':62B 'happen':108C,115C 'host':24B 'infrastructur':18B 'kernel':2A,21B,34B,72C 'legitim':94C 'linux':1A,20B,33B,71C 'linux-kernel':19B 'list':8A,43B,86C 'locking/rcu':96C 'lookup':107C 'may':49B 'mcast':84C 'memori':66B 'memory-ord':65B 'move':125C 'multicast':6A,41B 'need':98C 'netback':5A,28B,81C 'network':37B 'order':67B,89C 'past':153C 'path':142C 'point':156C 'poll':124C 'problem':68B 'process':48B,104C 'put':151C 'race':30B 'receiv':47B 'requir':145C 'resolv':78C 'run':100C 'self':23B 'self-host':22B 'sourc':55B 'start':111C 'state':58B 'still':50B 'synchron':155C 'transmit':45B 'tx':118C 'tx/rx':103C 'use':52B 'vulner':75C 'xen':4A,25B,27B,36B,80C 'xen-netback':3A,26B,79C 'xenvif':83C,110C,117C,123C,130C 'xmit':112C 'xsa':162C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel as a Xen host with the xen-netback network backend in use, typically Xen dom0 or driver domains. The sources do not say which kernel versions are affected or whether a default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linuxkernel","selfhosted","unknown","xen","xennetback"],"campaign_type":null,"search_a":"'-100081':14A,17A '-2026':13A,16A 'address':7A 'cve':12A,15A 'earli':11A 'freed':9A 'kernel':2A 'linux':1A 'list':8A 'multicast':6A 'netback':5A 'xen':4A 'xen-netback':3A","search_b":"'address':42B 'attack':61B 'backend':38B 'beyond':63B 'free':39B 'get':62B 'host':24B 'infrastructur':18B 'kernel':21B,34B 'linux':20B,33B 'linux-kernel':19B 'list':43B 'may':49B 'memori':66B 'memory-ord':65B 'multicast':41B 'netback':28B 'network':37B 'order':67B 'problem':68B 'process':48B 'race':30B 'receiv':47B 'self':23B 'self-host':22B 'sourc':55B 'state':58B 'still':50B 'transmit':45B 'use':52B 'xen':25B,27B,36B 'xen-netback':26B","search_c":"'-100081':166C '-2026':165C '-527':163C 'action':119C 'addr':85C 'adds/removes':114C 'avoid':95C 'backend':158C 'call':120C,127C,134C 'clean':147C 'connect':139C 'cve':164C 'data':132C 'defer':82C 'disconnect':131C,159C 'doesn':143C 'error':141C 'finished/stopped':106C 'follow':74C 'free':87C 'function':92C,137C 'happen':108C,115C 'kernel':72C 'legitim':94C 'linux':71C 'list':86C 'locking/rcu':96C 'lookup':107C 'mcast':84C 'move':125C 'need':98C 'netback':81C 'order':89C 'past':153C 'path':142C 'point':156C 'poll':124C 'process':104C 'put':151C 'requir':145C 'resolv':78C 'run':100C 'start':111C 'synchron':155C 'tx':118C 'tx/rx':103C 'vulner':75C 'xen':80C 'xen-netback':79C 'xenvif':83C,110C,117C,123C,130C 'xmit':112C 'xsa':162C","first_public_at":"2026-11-06T19:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100081","severity":null,"published_at":"2026-11-06T19:17:03+00:00","modified_at":"2026-11-06T19:17:03+00:00","first_seen_at":"2026-11-06T19:43:47+00:00","fetched_at":"2026-11-06T19:43:47+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}