---
id: "CVE-2026-100081"
page: "https://infrastack.ai/live/CVE-2026-100081"
kind: "vulnerability"
aliases: ["CVE-2026-100081"]
title: "Linux kernel: xen-netback multicast address list freed too early"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "self-hosted", "xen", "xen-netback"]
not_affected_if: ["no-xen-netback"]
published_at: "2026-11-06T19:17:03+00:00"
first_seen_at: "2026-11-06T19:43:47+00:00"
updated_at: "2026-11-06T19:46:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100081", "first_seen_at": "2026-11-06T19:43:47+00:00"}]
exploit_sources: []
---

# Linux kernel: xen-netback multicast address list freed too early

Link for people: https://infrastack.ai/live/CVE-2026-100081 (this .md is for agents)

A race in the Linux kernel's Xen network backend frees the multicast address list while transmit and receive processing may still be using it. The sources do not state what an attacker gets beyond this memory-ordering problem.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-06T19:43:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100081

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: defer xenvif_mcast_addr_list_free()

In order for the function to legitimately avoid locking/RCU, it needs to
run after all TX/RX processing has finished/stopped: Lookups happen from
xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
(called out of xenvif_poll()).

Move the call out of xenvif_disconnect_data() (the call to the function
from connect()'s error path doesn't require any cleaning up there), and
put it past the synchronization point in backend_disconnect().

This is XSA-527 / CVE-2026-100081.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_