AZL-112834: CVE-2026-100081 affecting package kernel 6.6.161.1-1

Q: Which deployments are most relevant to this issue?

The affected code is in the Xen netback backend. Systems that do not use Xen netback are not implicated by the described code path.

Q: What runtime condition is involved in triggering the flaw?

The issue concerns freeing the multicast address list before transmit and receive processing has fully finished or stopped. The relevant concurrent activity includes lookups from xenvif_start_xmit() and multicast-list additions or removals from xenvif_tx_action().

Q: How can I identify whether the listed affected package is present?

Check whether the installed Azure Linux kernel package is version 6.6.161.1-1, which is the package version identified in the advisory data. Also determine whether the system uses the Xen netback backend.

Published Nov 6, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: defer xenvifmcastaddrlistfree()

In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvifstartxmit(), while adds/removes happen from xenviftxaction() (called out of xenvifpoll()).

Move the call out of xenvifdisconnectdata() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backenddisconnect().

This is XSA-527 / CVE-2026-100081.

Affected Software

1 affected component

azure-linux/kernel<=6.6.161.1-1

Event History

Nov 6, 2026

Advisory Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-100081

Frequently Asked Questions

Which deployments are most relevant to this issue?

The affected code is in the Xen netback backend. Systems that do not use Xen netback are not implicated by the described code path.

What runtime condition is involved in triggering the flaw?

The issue concerns freeing the multicast address list before transmit and receive processing has fully finished or stopped. The relevant concurrent activity includes lookups from xenvif_start_xmit() and multicast-list additions or removals from xenvif_tx_action().

How can I identify whether the listed affected package is present?

Check whether the installed Azure Linux kernel package is version 6.6.161.1-1, which is the package version identified in the advisory data. Also determine whether the system uses the Xen netback backend.

AZL-112834: CVE-2026-100081 affecting package kernel 6.6.161.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are most relevant to this issue?

What runtime condition is involved in triggering the flaw?

How can I identify whether the listed affected package is present?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most relevant to this issue?

What runtime condition is involved in triggering the flaw?

How can I identify whether the listed affected package is present?