Skip to main content

VSA-2026-061: Use-after-free in the Linux kernel's xen-blkback driver (CVE-2026-100082 / XSA-528)

Published Updated Severity CVSS 4.0 Affected products
2026-11-10 2026-11-10 ⚪ N/A Not available yet - None
info

A use-after-free vulnerability in the Linux kernel's xen-blkback guest block driver was disclosed by the Xen Project Security Team. For Vates products, we are not impacted: XCP-ng does not use the xen-blkback driver in dom0, so the vulnerable code path is not reachable in a supported deployment. We include the fix in the kernel package anyway to stay aligned with the Xen Project advisories. For details on how we assign severity levels, see our Severity Levels Explained page.

Summary​

The xen-blkback driver does not serialise reads of the device I/O statistics against the freeing of the memory that holds them. This leads to a use-after-free when reading statistical counters while the device is being torn down.

Impact​

This most likely crashes the driver, and possibly the host, causing a Denial of Service (DoS) for the entire host.

Information leaks cannot be ruled out.

Status​

  • Released

Affected Versions​

  • XCP-ng 8.3: Not affected. The xen-blkback module is shipped in the kernel package but not used by XCP-ng.

Mitigation​

There is no known mitigation required, as XCP-ng is not impacted.

Resolution​

As of 2026-11-10, the kernel package for XCP-ng 8.3 has been updated in order to stay aligned with upstream.

List of packages fixing this issue:

  • XCP-ng 8.3:
    • kernel-4.19.19-8.0.46.16.xcpng8.3

Credits​

This issue was discovered by Yehyeong Lee of Hyundai Mobis.

References​