CVE-2026-100080: xen-netback: Fix UAF when reading statistics data

Published Nov 6, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: Fix UAF when reading statistics data

The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.g. due to illegal Xenstore data filled in by the guest), the statistic data is being freed without synchronizing the RCU state. In case the data is being read via sysfs in this phase, access to already freed memory or memory being in new use is possible.

Fix that by calling synchronizenet() before freeing the queue data.

This is XSA-526 / CVE-2026-100080

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Call synchronize_net() before freeing the queue data to synchronize the RCU state and prevent use-after-free when statistics data is read via sysfs.

Frequently Asked Questions

When can the use-after-free occur?

It can occur while xen-netback is tearing down queues after a frontend connection error, such as illegal Xenstore data supplied by the guest, if network statistics are read through sysfs during that teardown.

What access or conditions are needed to trigger this issue?

A guest must be able to cause an error while connecting to the Xen frontend, and statistics data must be read via sysfs during the resulting queue teardown. The description specifically identifies illegal Xenstore data filled in by the guest as an example trigger.

What is the impact of a successful race?

A sysfs statistics read may access memory that has already been freed or has been reused for another purpose.

What change resolves the unsafe teardown?

The fix synchronizes the network RCU state with synchronize_net() before freeing the queue data, preventing readers from accessing the statistics data after it is freed.

CVE-2026-100080: xen-netback: Fix UAF when reading statistics data

Remediation

Frequently Asked Questions

When can the use-after-free occur?

What access or conditions are needed to trigger this issue?

What is the impact of a successful race?

What change resolves the unsafe teardown?

Company

Resources

Contact

Frequently Asked Questions

When can the use-after-free occur?

What access or conditions are needed to trigger this issue?

What is the impact of a successful race?

What change resolves the unsafe teardown?