SUSE CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

SUSE CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

CVE-2026-99287

A flaw was found in the Linux kernel's Xen network backend xen-netback driver. When an error occurs while mapping communication rings for a guest domain, the driver fails to clear the ring pointers after unmapping them, causing the cleanup routine to unmap the same memory pointers a second time. ...

CVE-2026-99286

A flaw was found in the Linux kernel's xen-netback driver. During a virtual network connection failure, the driver deallocates queue resources before resetting the active queue count. A local user or guest domain could exploit this race condition by requesting network statistics during cleanup,...

CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

UBUNTU-CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

UBUNTU-CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

AZL-113317 CVE-2026-99287 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

AZL-113314 CVE-2026-99286 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

DEBIAN-CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

Linux xen-netback: guest can trigger use-after-free for network statistics reads

ISSUE DESCRIPTION The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend e.g. due to illegal Xenstore data filled in by the guest, there was missing RCU synchronization before freeing the memory...

Linux xen-netback: guest can trigger double unmap of memory

ISSUE DESCRIPTION When xen-netback is setting up the connection to a frontend, it is mapping the ring pages and then validating the ring pages' contents. In case the ring index values are illegal, xen-netback tries to unmap all allocated resources of the connection. Due to a missing test for...

CVE-2026-99287 xen-netback: Zero out sring pointers on unmap

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

CVE-2026-99287

The Linux kernel 's xen-netback driver is vulnerable to a double unmap of memory pages. When xenvif_map_frontend_data_rings() fails on an already mapped ring, it calls xenvif_unmap_frontend_data_rings() but fails to clear the ring pointers. Subsequent calls to xenvif_unmap_frontend_data_rings() d...

CVE-2026-99287 xen-netback: Zero out sring pointers on unmap

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...