CVE-2026-100082 · Infrastructure
NO FIX YET
Reading I/O statistics through sysfs while a Xen frontend device is being torn down can use freed memory or dereference a NULL pointer. The sources do not state what an attacker gets beyond a crash or memory corruption.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
No product ranges from the sources yet.
Who cares linux-kernel, xen, xen-blkback
Unknown from the sources.
Unknown from the sources.
In the Linux kernel, the following vulnerability has been resolved:
xen-blkback: Avoid UAF when reading I/O statistics
Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading of the statistics data is not synchronized with freeing the data.
Use a rwlock for synchronizing.
This is XSA-528 / CVE-2026-100082
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.