CVE-2026-100080 - Vulnerability Details

- xen-netback: Fix UAF when reading statistics data

Description

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: Fix UAF when reading statistics data

The network statistic data in the driver is protected by RCU.
Unfortunately when tearing down the queues after an error during
connecting to the frontend (e.g. due to illegal Xenstore data filled
in by the guest), the statistic data is being freed without
synchronizing the RCU state. In case the data is being read via sysfs
in this phase, access to already freed memory or memory being in new
use is possible.

Fix that by calling synchronize_net() before freeing the queue data.

This is XSA-526 / CVE-2026-100080

Published: 2026-11-06

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4223b33be49ee09acb6f1d26beb4a36dd3b8d63a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ab9cdf1291be551da999510b30216a2886074d7a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 36f858f228e3f955b9336af7f94634747c221518
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 89e534265b62c94749639350200b10370564bb3a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6cd611d2abdd8623a554e14145f82c1cb4e4467a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 37d5a73170579b30e67cc8b19ec69715eea3a6b6
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4867687b6ad28ab84bc0811d8f8f9972e769da02
`0`	affected	< 5.10.274
`0`	affected	< 5.15.225
`0`	affected	< 6.1.192
`0`	affected	< 6.6.162
`0`	affected	< 6.12.116
`0`	affected	< 6.18.62
`0`	affected	< 7.3.3

Linux

affected

Version	Status	Constraints
`5.10.274`	unaffected	≤ 5.10.*
`5.15.225`	unaffected	≤ 5.15.*
`6.1.192`	unaffected	≤ 6.1.*
`6.6.162`	unaffected	≤ 6.6.*
`6.12.116`	unaffected	≤ 6.12.*
`6.18.62`	unaffected	≤ 6.18.*
`7.3.3`	unaffected	≤ 7.3.*

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4223b33be49ee09acb6f1d26beb4a36dd3b8d63a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ab9cdf1291be551da999510b30216a2886074d7a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,36f858f228e3f955b9336af7f94634747c221518)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,89e534265b62c94749639350200b10370564bb3a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6cd611d2abdd8623a554e14145f82c1cb4e4467a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,37d5a73170579b30e67cc8b19ec69715eea3a6b6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4867687b6ad28ab84bc0811d8f8f9972e769da02)`	affected	code_commit	—
`[0,5.10.274)`	affected	semver	—
`[0,5.15.225)`	affected	semver	—
`[0,6.1.192)`	affected	semver	—
`[0,6.6.162)`	affected	semver	—
`[0,6.12.116)`	affected	semver	—
`[0,6.18.62)`	affected	semver	—
`[0,7.3.3)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.10.274,5.11.0)`	unaffected	semver	—
`[5.15.225,5.16.0)`	unaffected	semver	—
`[6.1.192,6.2.0)`	unaffected	semver	—
`[6.6.162,6.7.0)`	unaffected	semver	—
`[6.12.116,6.13.0)`	unaffected	semver	—
`[6.18.62,6.19.0)`	unaffected	semver	—
`[7.3.3,7.4.0)`	unaffected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4223b33be49ee09acb6f1d26beb4a36dd3b8d63a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ab9cdf1291be551da999510b30216a2886074d7a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,36f858f228e3f955b9336af7f94634747c221518)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,89e534265b62c94749639350200b10370564bb3a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6cd611d2abdd8623a554e14145f82c1cb4e4467a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,37d5a73170579b30e67cc8b19ec69715eea3a6b6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4867687b6ad28ab84bc0811d8f8f9972e769da02)`	affected	code_commit	—
`[0,5.10.274)`	affected	semver	—
`[0,5.15.225)`	affected	semver	—
`[0,6.1.192)`	affected	semver	—
`[0,6.6.162)`	affected	semver	—
`[0,6.12.116)`	affected	semver	—
`[0,6.18.62)`	affected	semver	—
`[0,7.3.3)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.10.274,5.11.0)`	unaffected	semver	—
`[5.15.225,5.16.0)`	unaffected	semver	—
`[6.1.192,6.2.0)`	unaffected	semver	—
`[6.6.162,6.7.0)`	unaffected	semver	—
`[6.12.116,6.13.0)`	unaffected	semver	—
`[6.18.62,6.19.0)`	unaffected	semver	—
`[7.3.3,7.4.0)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/11/06/9
http://xenbits.xen.org/xsa/advisory-526.html
https://git.kernel.org/stable/c/36f858f228e3f955b9336af7f94634747c221518
https://git.kernel.org/stable/c/37d5a73170579b30e67cc8b19ec69715eea3a6b6
https://git.kernel.org/stable/c/4223b33be49ee09acb6f1d26beb4a36dd3b8d63a
https://git.kernel.org/stable/c/4867687b6ad28ab84bc0811d8f8f9972e769da02
https://git.kernel.org/stable/c/6cd611d2abdd8623a554e14145f82c1cb4e4467a
https://git.kernel.org/stable/c/89e534265b62c94749639350200b10370564bb3a
https://git.kernel.org/stable/c/ab9cdf1291be551da999510b30216a2886074d7a

History

Fri, 06 Nov 2026 20:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Weaknesses		CWE-416
Vendors & Products		Linux linux

Fri, 06 Nov 2026 19:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/11/06/9 http://xenbits.xen.org/xsa/advisory-526.html

Fri, 06 Nov 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix UAF when reading statistics data The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.g. due to illegal Xenstore data filled in by the guest), the statistic data is being freed without synchronizing the RCU state. In case the data is being read via sysfs in this phase, access to already freed memory or memory being in new use is possible. Fix that by calling synchronize_net() before freeing the queue data. This is XSA-526 / CVE-2026-100080
Title		xen-netback: Fix UAF when reading statistics data
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/36f858f228e3f955b9336af7f94634747c221518 https://git.kernel.org/stable/c/37d5a73170579b30e67cc8b19ec69715eea3a6b6 https://git.kernel.org/stable/c/4223b33be49ee09acb6f1d26beb4a36dd3b8d63a https://git.kernel.org/stable/c/4867687b6ad28ab84bc0811d8f8f9972e769da02 https://git.kernel.org/stable/c/6cd611d2abdd8623a554e14145f82c1cb4e4467a https://git.kernel.org/stable/c/89e534265b62c94749639350200b10370564bb3a https://git.kernel.org/stable/c/ab9cdf1291be551da999510b30216a2886074d7a

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-11-06T18:23:01.824Z

Updated: 2026-11-06T19:08:40.599Z

Reserved: 2026-09-25T10:25:14.456Z

Link: CVE-2026-100080

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-06T19:17:03.190

Modified: 2026-11-06T19:17:03.190

Link: CVE-2026-100080

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-06T19:45:08Z

Weaknesses

CWE-416

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object