https://seclists.org/oss-sec/2026/q4/543: Xen Security Advisory 526 v1 (CVE-2026-100080) - Linux xen-netback: guest can trigger use-after-free for
Published Nov 6, 2026
·Updated
Affected Software
1 affected component
Linux Linux>=4.11
Linux versions 4.11 and newer are vulnerable when using the Linux xen-netback driver. The issue can be triggered during queue teardown after an error while connecting to a guest frontend.
A guest needs to cause an error during frontend connection, such as by supplying illegal Xenstore data. The unsafe access occurs if network statistics are read through sysfs while the affected queue teardown is in progress.
The most likely result is a driver crash, which may escalate to a host crash and cause a denial of service for the entire host. Information disclosure cannot be ruled out.
Use a userspace PV network backend, such as the qemu-based qnic backend, or use a dedicated network driver domain for each guest. Either approach mitigates the issue.