CVE-2026-45890: xen-netback: reject zero-queue configuration from guest

Q: Who is exposed to this denial-of-service condition?

Xen hosts using the Linux xen-netback backend are exposed if they serve a malicious or buggy Xen guest. The issue is triggered through the guest-controlled xenbus multi-queue-num-queues setting.

Q: What must an attacker be able to do to trigger the issue?

An attacker needs control of a Xen guest and must be able to set multi-queue-num-queues to 0. This causes the backend to attempt a zero-size allocation and emit a kernel warning.

Q: When does the warning become a host denial of service?

The host denial of service occurs on systems configured with panic_on_warn=1, because the zero-size allocation warning can panic the host. Without that setting, the provided information identifies a warning condition but does not state that the host will panic.

Q: How can administrators determine whether they are affected?

Check whether the host uses Linux xen-netback and whether guests can configure multiple network queues through xenbus. Also check whether panic_on_warn is set to 1, as that configuration makes the warning host-fatal.

Published May 27, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: reject zero-queue configuration from guest

A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requestednumqueues > xenvifmaxqueues) but not zero, allowing requestednumqueues=0 to reach vzalloc(arraysize(0, sizeof(struct xenvifqueue))), which triggers WARNONONCE(!size) in vmallocnoderange().

On systems with paniconwarn=1, this allows a guest-to-host denial of service.

The Xen network interface specification requires the queue count to be "greater than zero".

Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added.

Affected Software

8 affected components

Linux Linux kernel (xen-netback)

Linux Linux kernel>=3.16<5.10.252

Linux Linux kernel>=5.11<5.15.202

Linux Linux kernel>=5.16<6.1.165

Linux Linux kernel>=6.2<6.6.128

Linux Linux kernel>=6.7<6.12.75

Linux Linux kernel>=6.13<6.18.14

Linux Linux kernel>=6.19<6.19.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Add/ensure the zero check in the backend connect() validation path so that a Xen guest cannot send requested_num_queues=0 (reject zero-queue configuration).
Xen network backend (xen-blkback / xen-netback) requested_num_queues = must be greater than zero

Event History

May 27, 2026

CVE Published

via MITRE·12:17 PM

Data Sourced

via MITRE·12:17 PM

Description

Data Sourced

via NVD·02:17 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this denial-of-service condition?

Xen hosts using the Linux xen-netback backend are exposed if they serve a malicious or buggy Xen guest. The issue is triggered through the guest-controlled xenbus multi-queue-num-queues setting.

What must an attacker be able to do to trigger the issue?

An attacker needs control of a Xen guest and must be able to set multi-queue-num-queues to 0. This causes the backend to attempt a zero-size allocation and emit a kernel warning.

When does the warning become a host denial of service?

The host denial of service occurs on systems configured with panic_on_warn=1, because the zero-size allocation warning can panic the host. Without that setting, the provided information identifies a warning condition but does not state that the host will panic.

How can administrators determine whether they are affected?

Check whether the host uses Linux xen-netback and whether guests can configure multiple network queues through xenbus. Also check whether panic_on_warn is set to 1, as that configuration makes the warning host-fatal.

CVE-2026-45890: xen-netback: reject zero-queue configuration from guest

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service condition?

What must an attacker be able to do to trigger the issue?

When does the warning become a host denial of service?

How can administrators determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service condition?

What must an attacker be able to do to trigger the issue?

When does the warning become a host denial of service?

How can administrators determine whether they are affected?