HIGH Introduced in 2.6.12
xen-netback XenBus UAF
CVE-2026-99286
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues under rcu_read_lock. We need to unpublish vif->num_queues before synchronize_net to ensure that readers that come afterwards will not read a non-zero vif->num_queues and attempt to access invalid queues. This is the same cleanup algorithm as used in backend_disconnect and added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect"). This is XSA-531
02KernelScan AI Analysis
Risk summary
A malicious Xen guest (domU) can trigger a use-after-free in the host's xen-netback driver during XenBus connection failure cleanup, potentially achieving guest-to-host escape with arbitrary kernel memory read/write and code execution in dom0. The vulnerability affects any system running the Xen network backend driver with multiple guest VMs.
Vulnerability analysis
During XenBus connection failure cleanup, the xen-netback driver freed queue structures but left vif->num_queues non-zero until after synchronize_net(). RCU-protected readers (xenvif_get_stats, xenvif_get_ethtool_stats) could capture the stale non-zero queue count, pass the RCU grace period, and then dereference already-freed queue pointers. The fix moves the num_queues zeroing before synchronize_net() and uses a saved local copy for the cleanup loop, ensuring new readers see zero queues and never access freed memory. An attacker in a guest VM can trigger this by causing a connection failure at the right moment during frontend/backend negotiation.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 2.6.12 | 6.12.117 | ade3082dcdee |
| 6.18 | 2.6.12 | 6.18.63 | a97aa838903d |
| 7.3 | 2.6.12 | 7.3.4 | 07aca7d25ce8 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.114-cip34) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.190-cip62) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.272-cip79) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.272-cip79-rt35) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |