VSA-2026-060: Use-after-free in the Linux kernel's xen-netback driver (CVE-2026-100080 / XSA-526, CVE-2026-100081 / XSA-527, CVE-2026-99286 / XSA-531)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-11-10 | 2026-11-10 | ⚫ Critical | Not available yet | - XCP-ng 8.3 |
Multiple use-after-free vulnerabilities in the Linux kernel's xen-netback guest network driver were disclosed by the Xen Project Security Team. For Vates products, we classify the impact as Critical. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary
XSA-526 (CVE-2026-100080) & XSA-531 (CVE-2026-99286): The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.g. due to illegal Xenstore data filled in by the guest), there was missing RCU synchronization before freeing the memory holding the statistic data. This was meant to be fixed by the patch of XSA-526, but that patch failed to set the indication that the data should no longer be accessed, before waiting for RCU to have finished accesses. In case the data is being read via sysfs in this phase, access to already freed memory or memory being in new use is possible.
XSA-527 (CVE-2026-100081): Multicast handling in the driver is implemented as a lookup early on the transmit (guest receive) path. The respective function can be invoked in parallel with teardown of a device. Thus the lookup may access data which was already freed, with that memory perhaps already being in new use elsewhere.
Impact
The most likely outcome is a driver crash, possibly escalated to a host crash. This then is a Denial of Service (DoS) affecting the entire host. Information leaks cannot be ruled out.
For XSA-527, with very low likelihood, privilege escalation cannot be ruled out.
Status
- Released
Affected Versions
- XCP-ng 8.3: Affected.
Mitigation
There is no known mitigation for XCP-ng.
Resolution
A reboot is required for the updated kernel to take effect on XCP-ng.
As of 2026-11-10, the kernel package for XCP-ng 8.3 has been updated to address these issues.
List of packages fixing this issue:
- XCP-ng 8.3:
kernel-4.19.19-8.0.46.16.xcpng8.3
Credits
- XSA-526 / CVE-2026-100080 was discovered by Yehyeong Lee of Hyundai Mobis.
- XSA-527 / CVE-2026-100081 was discovered by kerhunt.
- XSA-531 / CVE-2026-99286 was discovered by Tu Dinh of Vates.