Bug 2568422 (CVE-2026-100080) - CVE-2026-100080 kernel: kernel: xen-netback: Denial of Service via use-after-free during queue teardown
Summary: CVE-2026-100080 kernel: kernel: xen-netback: Denial of Service via use-after-...
Keywords:
Status: NEW
Alias: CVE-2026-100080
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-06 18:31 UTC by OSIDB Bzimport
Modified: 2026-11-06 18:40 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-06 18:31:24 UTC 
In the Linux kernel, the following vulnerability has been resolved:

xen-netback: Fix UAF when reading statistics data

The network statistic data in the driver is protected by RCU.
Unfortunately when tearing down the queues after an error during
connecting to the frontend (e.g. due to illegal Xenstore data filled
in by the guest), the statistic data is being freed without
synchronizing the RCU state.  In case the data is being read via sysfs
in this phase, access to already freed memory or memory being in new
use is possible.

Fix that by calling synchronize_net() before freeing the queue data.

This is XSA-526 / CVE-2026-100080
Note You need to log in before you can comment on or make changes to this bug.