CVE-2026-99286

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99286", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.405Z", "datePublished": "2026-11-10T18:16:53.997Z", "dateUpdated": "2026-11-10T21:05:24.916Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:16:53.997Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Fix XenBus connection failure cleanup\n\nxenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues\nunder rcu_read_lock. We need to unpublish vif->num_queues before\nsynchronize_net to ensure that readers that come afterwards will not\nread a non-zero vif->num_queues and attempt to access invalid queues.\n\nThis is the same cleanup algorithm as used in backend_disconnect and\nadded in commit b17075d5c198 (\"xen-netback: fix race condition on XenBus\ndisconnect\").\n\nThis is XSA-531"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/xen-netback/xenbus.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ade3082dcdee17c5767069883936d64ff83f6c9f", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "a97aa838903d15f865d80809f5198ff459c6634a", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "07aca7d25ce8578fedde49855983a01c537a782b", "status": "affected", "versionType": "git"}, {"version": "0", "lessThan": "6.12.117", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "6.18.63", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "7.3.4", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/xen-netback/xenbus.c"], "versions": [{"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.63", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.4", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.18.63"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.3.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ade3082dcdee17c5767069883936d64ff83f6c9f"}, {"url": "https://git.kernel.org/stable/c/a97aa838903d15f865d80809f5198ff459c6634a"}, {"url": "https://git.kernel.org/stable/c/07aca7d25ce8578fedde49855983a01c537a782b"}], "title": "xen-netback: Fix XenBus connection failure cleanup", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/10/25"}, {"url": "http://xenbits.xen.org/xsa/advisory-531.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-10T21:05:24.916Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/xen-netback/xenbus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ade3082dcdee17c5767069883936d64ff83f6c9f", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "a97aa838903d15f865d80809f5198ff459c6634a", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "07aca7d25ce8578fedde49855983a01c537a782b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "6.12.117", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "6.18.63", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "7.3.4", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/xen-netback/xenbus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.63", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.4", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Fix XenBus connection failure cleanup\n\nxenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues\nunder rcu_read_lock. We need to unpublish vif->num_queues before\nsynchronize_net to ensure that readers that come afterwards will not\nread a non-zero vif->num_queues and attempt to access invalid queues.\n\nThis is the same cleanup algorithm as used in backend_disconnect and\nadded in commit b17075d5c198 (\"xen-netback: fix race condition on XenBus\ndisconnect\").\n\nThis is XSA-531"}], "id": "CVE-2026-99286", "lastModified": "2026-11-10T21:22:22.900", "metrics": {}, "published": "2026-11-10T19:22:31.930", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07aca7d25ce8578fedde49855983a01c537a782b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a97aa838903d15f865d80809f5198ff459c6634a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ade3082dcdee17c5767069883936d64ff83f6c9f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/10/25"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://xenbits.xen.org/xsa/advisory-531.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: xen-netback: Denial of Service via race condition during connection cleanup", "id": "2570095", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570095"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["A flaw was found in the Linux kernel's xen-netback driver. During a virtual network connection failure, the driver deallocates queue resources before resetting the active queue count. A local user or guest domain could exploit this race condition by requesting network statistics during cleanup, causing the system to access freed memory. This issue primarily leads to a denial of service (DoS) due to a kernel crash."], "mitigation": {"lang": "en:us", "value": "Prevent the xen-netback kernel module from being loaded by configuring modprobe:\n# echo \"install xen-netback /bin/true\" > /etc/modprobe.d/xen-netback.conf\nIf the module is already loaded into the running kernel, a system reboot is required for this mitigation to take effect.\nCaveat: Disabling this driver prevents the host system from providing network virtualization backend services to Xen guest domains."}, "name": "CVE-2026-99286", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-10T18:16:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99286\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99286\nhttps://git.kernel.org/stable/c/07aca7d25ce8578fedde49855983a01c537a782b\nhttps://git.kernel.org/stable/c/a97aa838903d15f865d80809f5198ff459c6634a\nhttps://git.kernel.org/stable/c/ade3082dcdee17c5767069883936d64ff83f6c9f"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation is confined to causing a host denial of service without compromising data confidentiality or system integrity. In default Red Hat Enterprise Linux deployments, systems do not operate as Xen backend virtualization hosts, which minimizes the attack surface. Furthermore, triggering the condition requires winning a narrow race during connection teardown while querying network device statistics from an adjacent guest domain or local user.", "threat_severity": "Moderate"}

{}