CVE-2026-100082: xen-blkback: Avoid UAF when reading I/O statistics
Published Nov 6, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
xen-blkback: Avoid UAF when reading I/O statistics
Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading of the statistics data is not synchronized with freeing the data.
Use a rwlock for synchronizing.
This is XSA-528 / CVE-2026-100082
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In Linux xen-blkback, synchronize reading I/O statistics via sysfs with teardown/freeing of the frontend device by using a rwlock, preventing use-after-free or NULL dereference.
Event History
Nov 6, 2026
CVE Published
via MITRE·06:23 PM
Data Sourced
via MITRE·06:23 PM
Description