{"id":"CVE-2026-99287","kind":"vulnerability","aliases":["CVE-2026-99287"],"related":[],"title":"Linux kernel xen-netback: double unmap of ring pointers on connect failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Zero out sring pointers on unmap\n\nIf xenvif_map_frontend_data_rings() fails when a ring is already mapped,\nit unmaps them via xenvif_unmap_frontend_data_rings() which keeps the\nring pointers unchanged. xenvif_connect_data()'s cleanup path calls\nxenvif_disconnect_queue() which in turn calls\nxenvif_unmap_frontend_data_rings() again, which will attempt to unmap the\npointers a second time.\n\nZero out the ring pointers after they are unmapped to avoid this issue.\n\nThis is XSA-532","summary":"When mapping the frontend data rings fails after one ring is already mapped, the xen-netback driver unmaps them and then unmaps the same pointers again during cleanup. The sources do not state what an attacker gets from the second unmap.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","xen","xen-netback"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:22:32+00:00","first_seen_at":"2026-11-10T19:25:35+00:00","triaged_at":"2026-11-10T20:04:40+00:00","updated_at":"2026-11-10T20:04:40+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T20:04:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel xen-netback: double unmap of ring pointers on connect failure","impact":"medium","summary":"When mapping the frontend data rings fails after one ring is already mapped, the xen-netback driver unmaps them and then unmaps the same pointers again during cleanup. The sources do not state what an attacker gets from the second unmap.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","xen","xen-netback"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; a double unmap may crash or corrupt kernel memory","analyst_note":"Find the kernel commit and XSA-532 advisory to confirm affected versions, fixed versions and the attacker-controlled impact.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affects Linux kernels with the Xen netback driver, used by Xen guests and hosts doing network backend work. The sources do not say which kernel versions are affected or whether the flaw is reachable by a guest. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000701,"input_tokens":4677,"output_tokens":467,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-532':163C '-99287':16A,19A 'alreadi':39B,100C 'attack':64B 'attempt':139C 'avoid':157C 'call':123C,130C 'cleanup':56B,121C 'connect':12A,118C 'cve':14A,17A 'data':32B,93C,109C,119C,134C 'disconnect':125C 'doubl':6A 'driver':45B 'fail':34B,95C 'failur':13A 'follow':75C 'frontend':31B,92C,108C,133C 'get':65B 'infrastructur':20B 'issu':159C 'keep':112C 'kernel':2A,23B,73C 'linux':1A,22B,72C 'linux-kernel':21B 'map':29B,40B,91C,101C 'netback':5A,27B,44B,82C 'one':36B 'path':122C 'pointer':10A,53B,86C,115C,143C,151C 'queue':126C 'resolv':79C 'ring':9A,33B,37B,94C,98C,110C,114C,135C,150C 'second':68B,145C 'sourc':58B 'sring':85C 'state':61B 'time':146C 'turn':129C 'unchang':116C 'unmap':7A,46B,50B,69B,88C,103C,107C,132C,141C,155C 'via':105C 'vulner':76C 'xen':4A,24B,26B,43B,81C 'xen-netback':3A,25B,42B,80C 'xenvif':90C,106C,117C,124C,131C 'xsa':162C 'zero':83C,147C","nicknames":[],"mitigations":[],"who_affected":"Affects Linux kernels with the Xen netback driver, used by Xen guests and hosts doing network backend work. The sources do not say which kernel versions are affected or whether the flaw is reachable by a guest. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linuxkernel","unknown","xen","xennetback"],"campaign_type":null,"search_a":"'-2026':15A,18A '-99287':16A,19A 'connect':12A 'cve':14A,17A 'doubl':6A 'failur':13A 'kernel':2A 'linux':1A 'netback':5A 'pointer':10A 'ring':9A 'unmap':7A 'xen':4A 'xen-netback':3A","search_b":"'alreadi':39B 'attack':64B 'cleanup':56B 'data':32B 'driver':45B 'fail':34B 'frontend':31B 'get':65B 'infrastructur':20B 'kernel':23B 'linux':22B 'linux-kernel':21B 'map':29B,40B 'netback':27B,44B 'one':36B 'pointer':53B 'ring':33B,37B 'second':68B 'sourc':58B 'state':61B 'unmap':46B,50B,69B 'xen':24B,26B,43B 'xen-netback':25B,42B","search_c":"'-532':163C 'alreadi':100C 'attempt':139C 'avoid':157C 'call':123C,130C 'cleanup':121C 'connect':118C 'data':93C,109C,119C,134C 'disconnect':125C 'fail':95C 'follow':75C 'frontend':92C,108C,133C 'issu':159C 'keep':112C 'kernel':73C 'linux':72C 'map':91C,101C 'netback':82C 'path':122C 'pointer':86C,115C,143C,151C 'queue':126C 'resolv':79C 'ring':94C,98C,110C,114C,135C,150C 'second':145C 'sring':85C 'time':146C 'turn':129C 'unchang':116C 'unmap':88C,103C,107C,132C,141C,155C 'via':105C 'vulner':76C 'xen':81C 'xen-netback':80C 'xenvif':90C,106C,117C,124C,131C 'xsa':162C 'zero':83C,147C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99287","severity":null,"published_at":"2026-11-10T19:22:32+00:00","modified_at":"2026-11-10T19:22:32+00:00","first_seen_at":"2026-11-10T19:25:35+00:00","fetched_at":"2026-11-10T19:25:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}