{"id":"CVE-2026-99286","kind":"vulnerability","aliases":["CVE-2026-99286"],"related":[],"title":"Linux kernel: xen-netback connection failure cleanup race can read invalid queues","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Fix XenBus connection failure cleanup\n\nxenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues\nunder rcu_read_lock. We need to unpublish vif->num_queues before\nsynchronize_net to ensure that readers that come afterwards will not\nread a non-zero vif->num_queues and attempt to access invalid queues.\n\nThis is the same cleanup algorithm as used in backend_disconnect and\nadded in commit b17075d5c198 (\"xen-netback: fix race condition on XenBus\ndisconnect\").\n\nThis is XSA-531","summary":"In the Linux kernel's Xen network backend (xen-netback), a failed XenBus connection cleanup can leave the queue count visible to statistics readers while the queues are being torn down. The sources do not state what an attacker gains beyond a possible invalid memory access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","xen","xen-netback"],"not_affected_if":["no-xen-backend"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:22:31+00:00","first_seen_at":"2026-11-10T19:25:35+00:00","triaged_at":"2026-11-10T20:04:41+00:00","updated_at":"2026-11-10T20:04:41+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:04:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: xen-netback connection failure cleanup race can read invalid queues","impact":"medium","summary":"In the Linux kernel's Xen network backend (xen-netback), a failed XenBus connection cleanup can leave the queue count visible to statistics readers while the queues are being torn down. The sources do not state what an attacker gains beyond a possible invalid memory access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","xen","xen-netback"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; invalid queue access may crash or corrupt the backend","analyst_note":"Check the NVD entry and the kernel stable commit for CVE-2026-99286 to confirm fixed kernel versions and the exploit impact.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-xen-backend"],"who_is_affected":"Affects Linux hosts acting as Xen paravirtualized network backends (dom0 or driver domains running xen-netback). Systems not running Xen network backends are not affected by this description. The sources do not give further detail.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4669,"output_tokens":474,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-531':170C '-99286':16A,19A 'access':74B,139C 'add':154C 'afterward':125C 'algorithm':147C 'attack':67B 'attempt':137C 'b17075d5c198':157C 'backend':35B,151C 'beyond':69B 'captur':101C 'cleanup':8A,43B,92C,146C 'come':124C 'commit':156C 'condit':163C 'connect':6A,42B,90C 'count':48B 'cve':14A,17A 'disconnect':152C,166C 'ensur':120C 'ethtool':99C 'fail':40B 'failur':7A,91C 'fix':88C,161C 'follow':80C 'gain':68B 'get':94C,98C 'infrastructur':20B 'invalid':12A,72B,140C 'kernel':2A,23B,31B,78C 'leav':45B 'linux':1A,22B,30B,77C 'linux-kernel':21B 'lock':108C 'memori':73B 'need':110C 'net':118C 'netback':5A,27B,38B,87C,160C 'network':34B 'non':131C 'non-zero':130C 'num':103C,114C,134C 'possibl':71B 'queue':13A,47B,55B,104C,115C,135C,141C 'race':9A,162C 'rcu':106C 'read':11A,107C,128C 'reader':52B,122C 'resolv':84C 'sourc':61B 'stat':95C,100C 'state':64B 'statist':51B 'synchron':117C 'torn':58B 'unpublish':112C 'use':149C 'vif':102C,113C,133C 'visibl':49B 'vulner':81C 'xen':4A,24B,26B,33B,37B,86C,159C 'xen-netback':3A,25B,36B,85C,158C 'xenbus':41B,89C,165C 'xenvif':93C,97C 'xsa':169C 'zero':132C","nicknames":[],"mitigations":[],"who_affected":"Affects Linux hosts acting as Xen paravirtualized network backends (dom0 or driver domains running xen-netback). Systems not running Xen network backends are not affected by this description. The sources do not give further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linuxkernel","unknown","xen","xennetback"],"campaign_type":null,"search_a":"'-2026':15A,18A '-99286':16A,19A 'cleanup':8A 'connect':6A 'cve':14A,17A 'failur':7A 'invalid':12A 'kernel':2A 'linux':1A 'netback':5A 'queue':13A 'race':9A 'read':11A 'xen':4A 'xen-netback':3A","search_b":"'access':74B 'attack':67B 'backend':35B 'beyond':69B 'cleanup':43B 'connect':42B 'count':48B 'fail':40B 'gain':68B 'infrastructur':20B 'invalid':72B 'kernel':23B,31B 'leav':45B 'linux':22B,30B 'linux-kernel':21B 'memori':73B 'netback':27B,38B 'network':34B 'possibl':71B 'queue':47B,55B 'reader':52B 'sourc':61B 'state':64B 'statist':51B 'torn':58B 'visibl':49B 'xen':24B,26B,33B,37B 'xen-netback':25B,36B 'xenbus':41B","search_c":"'-531':170C 'access':139C 'add':154C 'afterward':125C 'algorithm':147C 'attempt':137C 'b17075d5c198':157C 'backend':151C 'captur':101C 'cleanup':92C,146C 'come':124C 'commit':156C 'condit':163C 'connect':90C 'disconnect':152C,166C 'ensur':120C 'ethtool':99C 'failur':91C 'fix':88C,161C 'follow':80C 'get':94C,98C 'invalid':140C 'kernel':78C 'linux':77C 'lock':108C 'need':110C 'net':118C 'netback':87C,160C 'non':131C 'non-zero':130C 'num':103C,114C,134C 'queue':104C,115C,135C,141C 'race':162C 'rcu':106C 'read':107C,128C 'reader':122C 'resolv':84C 'stat':95C,100C 'synchron':117C 'unpublish':112C 'use':149C 'vif':102C,113C,133C 'vulner':81C 'xen':86C,159C 'xen-netback':85C,158C 'xenbus':89C,165C 'xenvif':93C,97C 'xsa':169C 'zero':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99286","severity":null,"published_at":"2026-11-10T19:22:31+00:00","modified_at":"2026-11-10T19:22:31+00:00","first_seen_at":"2026-11-10T19:25:35+00:00","fetched_at":"2026-11-10T19:25:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}