UBUNTU-CVE-2026-99287: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings() fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings() which keeps the ring pointers unchanged. xenvifconnectdata()'s cleanup path calls xenvifdisconnectqueue() which in turn calls xenvifunmapfrontenddatarings() again, which will attempt to unmap the pointers a second time. Zero out the ring pointers after they are unmapped to avoid this issue. This is XSA-532
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch XSA-532
Event History
Frequently Asked Questions
Which Ubuntu kernel package families are covered?
The affected software list includes ubuntu/linux-fips, ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.
What condition leads to the faulty cleanup behavior?
The issue occurs when xenvif_map_frontend_data_rings() fails while a ring is already mapped. Its cleanup can unmap the ring once without clearing its pointers, after which a later cleanup path can attempt to unmap the same pointers again.