CVE-2026-100081
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()). Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect(). This is XSA-527 / CVE-2026-100081.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-11-06 19:17:03.373000
Last modified
2026-11-06 19:17:03.373000
View original CVE JSON
{
"id": "CVE-2026-100081",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-11-06T19:17:03.373",
"lastModified": "2026-11-06T19:17:03.373",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()'s error path doesn't require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/xen-netback/interface.c",
"drivers/net/xen-netback/xenbus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "b17075d5c1988b83f840d272c795ac17d57ce804",
"lessThan": "96e05a8ce243e2207704e2e7a6e7d1172730f515",
"versionType": "git",
"status": "affected"
},
{
"version": "b17075d5c1988b83f840d272c795ac17d57ce804",
"lessThan": "0e786123e46d08d2247ce93a5435e45ed9f4c5d1",
"versionType": "git",
"status": "affected"
},
{
"version": "b17075d5c1988b83f840d272c795ac17d57ce804",
"lessThan": "990d123d9eaa3ac6c979eed245658676d65ce0db",
"versionType": "git",
"status": "affected"
},
{
"version": "b17075d5c1988b83f840d272c795ac17d57ce804",
"lessThan": "0d515c409033c8e2a645a781be3ca76ab825fc8c",
"versionType": "git",
"status": "affected"
},
{
"version": "b17075d5c1988b83f840d272c795ac17d57ce804",
"lessThan": "a6bb2f1fa62c56279bdcdadce28d1310c5e12b62",
"versionType": "git",
"status": "affected"
},
{
"version": "b17075d5c1988b83f840d272c795ac17d57ce804",
"lessThan": "34f0f63dc6dc11895a17bb5672451b6b11622c99",
"versionType": "git",
"status": "affected"
},
{
"version": "b17075d5c1988b83f840d272c795ac17d57ce804",
"lessThan": "fb38fc58acb26d74fe8f7b19621fafaae3c040ff",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/xen-netback/interface.c",
"drivers/net/xen-netback/xenbus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.11",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.11",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.274",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.225",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.192",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.162",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.116",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.62",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3.3",
"lessThanOrEqual": "7.3.*",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/11/06/10",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://xenbits.xen.org/xsa/advisory-527.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}