CVE-2026-99287

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99287", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.405Z", "datePublished": "2026-11-10T18:16:54.253Z", "dateUpdated": "2026-11-10T21:05:27.340Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:16:54.253Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Zero out sring pointers on unmap\n\nIf xenvif_map_frontend_data_rings() fails when a ring is already mapped,\nit unmaps them via xenvif_unmap_frontend_data_rings() which keeps the\nring pointers unchanged. xenvif_connect_data()'s cleanup path calls\nxenvif_disconnect_queue() which in turn calls\nxenvif_unmap_frontend_data_rings() again, which will attempt to unmap the\npointers a second time.\n\nZero out the ring pointers after they are unmapped to avoid this issue.\n\nThis is XSA-532"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/xen-netback/netback.c"], "versions": [{"version": "2ac061ce97f413bfbbdd768f7d2e0fda2e8170df", "lessThan": "87fd475dc4e354088f6534285388e7b061f54b35", "status": "affected", "versionType": "git"}, {"version": "2ac061ce97f413bfbbdd768f7d2e0fda2e8170df", "lessThan": "c5f54af611ff6fe1d53fa05d8e87b469dc56122b", "status": "affected", "versionType": "git"}, {"version": "2ac061ce97f413bfbbdd768f7d2e0fda2e8170df", "lessThan": "e7ba61734d6ad6adfd5bf617052e590743211669", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/xen-netback/netback.c"], "versions": [{"version": "5.5", "status": "affected"}, {"version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.63", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.4", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.18.63"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "7.3.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/87fd475dc4e354088f6534285388e7b061f54b35"}, {"url": "https://git.kernel.org/stable/c/c5f54af611ff6fe1d53fa05d8e87b469dc56122b"}, {"url": "https://git.kernel.org/stable/c/e7ba61734d6ad6adfd5bf617052e590743211669"}], "title": "xen-netback: Zero out sring pointers on unmap", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/10/26"}, {"url": "http://xenbits.xen.org/xsa/advisory-532.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-10T21:05:27.340Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/xen-netback/netback.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "87fd475dc4e354088f6534285388e7b061f54b35", "status": "affected", "version": "2ac061ce97f413bfbbdd768f7d2e0fda2e8170df", "versionType": "git"}, {"lessThan": "c5f54af611ff6fe1d53fa05d8e87b469dc56122b", "status": "affected", "version": "2ac061ce97f413bfbbdd768f7d2e0fda2e8170df", "versionType": "git"}, {"lessThan": "e7ba61734d6ad6adfd5bf617052e590743211669", "status": "affected", "version": "2ac061ce97f413bfbbdd768f7d2e0fda2e8170df", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/xen-netback/netback.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"lessThan": "5.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.63", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.4", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Zero out sring pointers on unmap\n\nIf xenvif_map_frontend_data_rings() fails when a ring is already mapped,\nit unmaps them via xenvif_unmap_frontend_data_rings() which keeps the\nring pointers unchanged. xenvif_connect_data()'s cleanup path calls\nxenvif_disconnect_queue() which in turn calls\nxenvif_unmap_frontend_data_rings() again, which will attempt to unmap the\npointers a second time.\n\nZero out the ring pointers after they are unmapped to avoid this issue.\n\nThis is XSA-532"}], "id": "CVE-2026-99287", "lastModified": "2026-11-10T21:22:23.010", "metrics": {}, "published": "2026-11-10T19:22:32.043", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87fd475dc4e354088f6534285388e7b061f54b35"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c5f54af611ff6fe1d53fa05d8e87b469dc56122b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7ba61734d6ad6adfd5bf617052e590743211669"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/10/26"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://xenbits.xen.org/xsa/advisory-532.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: xen-netback: Denial of Service via double unmapping of shared data rings", "id": "2570538", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570538"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["A flaw was found in the Linux kernel's Xen network backend (xen-netback) driver. When an error occurs while mapping communication rings for a guest domain, the driver fails to clear the ring pointers after unmapping them, causing the cleanup routine to unmap the same memory pointers a second time. A malicious guest domain can exploit this issue during connection handling to trigger memory corruption, resulting in a host system crash and Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, prevent the xen-netback kernel module from loading on the system.\n1. Create a configuration file to disable autoloading of the module:\n```\necho \"install xen-netback /bin/true\" > /etc/modprobe.d/xen-netback.conf\n```\n2. If the module is already active in the running kernel, unload it:\n```\nmodprobe -r xen-netback\n```\nWarning: Disabling or unloading this module will terminate network connectivity for Xen guests relying on this host and prevent new Xen virtual network interfaces from functioning. If the module is currently in use and cannot be unloaded, a system restart will be required to apply the configuration."}, "name": "CVE-2026-99287", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-10T18:16:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99287\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99287\nhttps://git.kernel.org/stable/c/87fd475dc4e354088f6534285388e7b061f54b35\nhttps://git.kernel.org/stable/c/c5f54af611ff6fe1d53fa05d8e87b469dc56122b\nhttps://git.kernel.org/stable/c/e7ba61734d6ad6adfd5bf617052e590743211669"], "statement": "This vulnerability is evaluated as a Moderate severity flaw because exploitation is limited to causing a host denial of service from an attached virtual guest, without allowing arbitrary code execution or data leakage. The issue occurs exclusively when operating as a Xen backend network driver domain handling shared memory communications with virtual guests. Red Hat Enterprise Linux defaults to KVM for virtualization and does not support Xen host operations in standard deployments, meaning most installations do not run the affected backend service and remain unaffected.", "threat_severity": "Moderate"}

{}