HIGH Introduced in 5.5
xen-netback Sring DoubleFree
CVE-2026-99287
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvif_map_frontend_data_rings() fails when a ring is already mapped, it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the ring pointers unchanged. xenvif_connect_data()'s cleanup path calls xenvif_disconnect_queue() which in turn calls xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the pointers a second time. Zero out the ring pointers after they are unmapped to avoid this issue. This is XSA-532
02KernelScan AI Analysis
Risk summary
A malicious Xen guest can trigger a double-free in the dom0 kernel's netback driver by forcing a reconnection sequence that causes the shared ring pointers to be unmapped twice. This allows the guest to escape to the privileged dom0 domain, achieving arbitrary code execution with full host privileges. Cloud and multi-tenant Xen deployments are at highest risk.
Vulnerability analysis
The xen-netback driver fails to clear shared ring pointers after unmapping them during a failed remap attempt. When a guest frontend reconnects, the driver's error path unmaps the rings but leaves the pointers dangling; the subsequent cleanup path then unmaps the same pointers a second time, causing a double-free. The fix sets the tx and rx ring pointers to NULL immediately after each unmap, so repeated calls safely become no-ops. The vulnerability is reachable from any guest VM with a network frontend — no host privileges are needed — making it a practical VM escape vector in multi-tenant Xen environments.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.5 | 6.12.117 | 87fd475dc4e3 |
| 6.18 | 5.5 | 6.18.63 | c5f54af611ff |
| 7.3 | 5.5 | 7.3.4 | e7ba61734d6a |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.114-cip34) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.190-cip62) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.272-cip79) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.272-cip79-rt35) |