EN PT-BR
← Voltar ao feed
high

Xen XSA-526/527/528: use-after-free flaws in Linux xen-netback and xen-blkback (CVE-2026-100080/81/82), fixed in Linux 6.12.116

1 fonte(s) · 2 atualização(ões) · publicado 08/11/2026 21:00 · coletado há 13 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que a fonte trouxe em 14/11/2026 00:03; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ×2 ↗

The Xen Project published three advisories on 6 November 2026, XSA-526, XSA-527 and XSA-528, tracked as CVE-2026-100080, CVE-2026-100081 and CVE-2026-100082 (cert.cyber.gouv.fr). All three are use-after-free flaws in the Linux kernel Xen backends xen-netback (network) and xen-blkback (block), triggered during device teardown. The advisories describe the trigger as coming from a guest, so the risk lies with a tenant or compromised guest and not with an external network attacker (xenbits.xen.org). The expected main impact is a driver or host crash (denial of service), and information leaks cannot be ruled out for XSA-526 and XSA-528 (xenbits.xen.org). No exploitation has been reported, and the advisories give no CVSS score. A later CERT-FR notice, dated 13 November 2026, ties the CVEs to Debian trixie kernels before 6.12.116-1 and describes a broader impact (cert.cyber.gouv.fr). Patches are available.

Entenda a falha

A vulnerabilidade

Three use-after-free flaws in the Linux kernel Xen backends, published by the Xen Project on 6 November 2026. CVE-2026-100080 (XSA-526) is in xen-netback, Linux 4.11 and newer, and CVE-2026-100081 (XSA-527) is in xen-netback, Linux 4.3 and newer. CVE-2026-100082 (XSA-528) is in xen-blkback, Linux 4.5 and newer. The trigger comes from a guest, so the threat is a tenant or compromised guest, not an outside network attacker. The main impact is a driver or host crash (denial of service). Information leaks cannot be ruled out for XSA-526 and XSA-528. CERT-FR's 13 November notice also lists privilege escalation and security policy bypass, but the Xen advisories and Qubes OS do not support that. Debian trixie kernels before 6.12.116-1 are affected, and the fixes are in Linux 6.12.116. No CVSS score was given.

Como funciona

In each case the guest side of a paravirtual device is being torn down while other kernel code still uses the same memory. For XSA-526, queues of xen-netback are torn down after an error while the frontend connects, for example after illegal Xenstore data written by the guest, and the per-queue statistics are freed without waiting for RCU readers. A sysfs read of those statistics in that window touches freed memory. For XSA-527, the multicast lookup on the guest-receive transmit path can run in parallel with teardown and read a freed address list. For XSA-528, xen-blkback reads I/O statistics while the memory holding them is being freed.

Por que é vulnerável

The root cause is missing synchronization between teardown and concurrent readers. In XSA-526 the xen-netback statistics are RCU-protected but are freed without RCU synchronization. In XSA-528 xen-blkback reads I/O statistics without serializing against the freeing. In XSA-527 the multicast address list is freed while TX and RX processing can still use it. The XSA-527 fix defers freeing the list until TX and RX processing has stopped. The articles do not say why the bugs went unnoticed for years.

Onde está

The code is in the Linux kernel drivers xen-netback and xen-blkback. The upstream fixes in the Linux 6.12.116 changelog are commit a02926f7c89bfc798ee9514e09694ff4279928a1 'xen-blkback: Avoid UAF when reading I/O statistics' (XSA-528) and commit bfddc420afe827d9f06458cdf8087cd602f8c9cb 'xen-netback: defer xenvif_mcast_addr_list_free()' (XSA-527). The advisories ship xsa526-linux.patch, xsa527-linux.patch and xsa528-linux.patch.

Como foi descoberta

The Xen advisories credit Yehyeong Lee of Hyundai Mobis for XSA-526 and Yehyeong Lee for XSA-528, and kerhunt for XSA-527. The articles do not say how they found the flaws. The Xen Project published the three advisories on 6 November 2026. CERT-FR issued a notice on 9 November based on them and another on 13 November for Debian trixie, pointing to Debian bulletin msg00536 of 8 November. Both notices report no evidence of active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 14/11/2026 00:18.

Detalhes técnicos

  • XSA-526 / CVE-2026-100080: the per-queue statistics of xen-netback are protected by RCU. When queues are torn down after an error during frontend connection (for example after illegal Xenstore data written by the guest), the memory is freed without RCU synchronization. A sysfs read in that window touches freed memory. Linux 4.11 and newer are affected. Credit: Yehyeong Lee of Hyundai Mobis (xenbits.xen.org).
  • XSA-527 / CVE-2026-100081: the multicast lookup on the guest-receive transmit path can run in parallel with device teardown and read freed data. Linux 4.3 and newer are affected. Credit: kerhunt (xenbits.xen.org).
  • XSA-528 / CVE-2026-100082: xen-blkback reads I/O statistics without serializing against the freeing of that memory, causing a use-after-free during teardown. Linux 4.5 and newer are affected. Credit: Yehyeong Lee (xenbits.xen.org).
  • Qubes OS classed all three as denial of service only and said no user action is needed on Qubes (qubes-os.org, seen in search results cited by cert.cyber.gouv.fr).

Remediação

  • Each advisory ships a Linux kernel patch: xsa526-linux.patch, xsa527-linux.patch and xsa528-linux.patch (xenbits.xen.org).
  • Upstream commits recorded in the Linux 6.12.116 changelog (cdn.kernel.org, seen in search results): a02926f7c89bfc798ee9514e09694ff4279928a1 'xen-blkback: Avoid UAF when reading I/O statistics' (XSA-528) and bfddc420afe827d9f06458cdf8087cd602f8c9cb 'xen-netback: defer xenvif_mcast_addr_list_free()' (XSA-527). The XSA-527 change defers freeing the multicast address list until TX and RX processing has stopped.
  • The changelog names Juergen Gross as signer of the XSA-528 fix. A news report names Juergen Gross and Jan Beulich as authors of the three fixes (linuxcompatible.org, seen in search results).
  • Mitigations named by the advisories: run a userspace PV backend (the qemu-based qnic for network, qdisk for block) or use a dedicated driver domain per guest (xenbits.xen.org).
  • Debian trixie users should apply the kernel update per the Debian security announcement referenced by CERT-FR (cert.cyber.gouv.fr).

Relatos divergentes

  • Impact: the 9 November CERT-FR notice, based on the Xen advisories, sees denial of service as the main outcome, with possible information leaks for XSA-526 and XSA-528, and rates urgency as medium (cert.cyber.gouv.fr). The 13 November CERT-FR notice lists privilege escalation, confidentiality breaches and security policy bypass, and calls the risk high (cert.cyber.gouv.fr). The Xen advisories and Qubes OS do not support privilege escalation, so treat that wording as unconfirmed. The 13 November notice is the more recent, but the vendor advisories are the more authoritative on technical impact.
  • Affected Debian version: the 13 November notice says Debian trixie kernels before 6.12.116-1 are affected, while the earlier notice records the fixes in the Linux 6.12.116 changelog. Both are consistent with 6.12.116-1 being the fixed build.
  • Exploitation: both notices report no evidence of active exploitation.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 12/11/2026 21:00 · coletado 13/11 12:01

    Multiple Privilege Escalation and Data Confidentiality Vulnerabilities in Debian Linux Kernel 6.12.116-1 and Earlier

    ler a análise desta fonte

    The French CERT-FR has disclosed multiple vulnerabilities in the Debian Linux kernel affecting Debian trixie versions prior to 6.12.116-1. These flaws include privilege escalation, data confidentiality breaches, and security policy bypasses. The advisory references Debian security bulletin msg00536 and three CVEs (CVE-2026-100080, CVE-2026-100081, CVE-2026-100082). Users are urged to apply patches as detailed in the official Debian security announcement. No evidence of active exploitation is reported, but the vulnerabilities pose a high risk due to their nature and kernel-level impact.

  2. cert.cyber.gouv.fr ↗ · pub. 08/11/2026 21:00 · coletado 09/11 14:01 primeiro registro

    Xen security advisories XSA-526, XSA-527 and XSA-528: use-after-free flaws in Linux xen-netback and xen-blkback drivers

    ler a análise desta fonte

    The Xen Project published three security advisories on 6 November 2026, XSA-526, XSA-527 and XSA-528, which the CERT-FR notice relays under CVE-2026-100080, CVE-2026-100081 and CVE-2026-100082. All three are use-after-free conditions in the Linux kernel backends that serve Xen guests, xen-netback (network) and xen-blkback (block), and they appear while a device is being torn down. The advisories describe the trigger as coming from a guest, so the threat sits with a tenant or compromised guest on the host rather than with an external network attacker (xenbits.xen.org). The vendor expects a driver or host crash, making denial of service the main outcome, and information leaks cannot be ruled out for XSA-526 and XSA-528 (xenbits.xen.org). The research found no exploitation report and the advisories opened do not state a CVSS score, so the urgency is medium.

    Technical Details

    • XSA-526 / CVE-2026-100080: the per-queue statistics of xen-netback are protected by RCU, but when queues are torn down after an error during frontend connection (for example after illegal Xenstore data written by the guest), the memory is freed without an RCU synchronization, so a sysfs read in that window touches freed memory. Linux 4.11 and newer are affected (xenbits.xen.org). The advisory credits Yehyeong Lee of Hyundai Mobis (xenbits.xen.org).
    • XSA-527 / CVE-2026-100081: the multicast lookup on the guest-receive transmit path can run in parallel with device teardown and read freed data. Linux 4.3 and newer are affected, and the advisory credits kerhunt (xenbits.xen.org).
    • XSA-528 / CVE-2026-100082: xen-blkback reads I/O statistics without serializing them against the freeing of that memory, which causes a use-after-free during teardown. Linux 4.5 and newer are affected, and the advisory credits Yehyeong Lee (xenbits.xen.org).
    • Mitigations named by the advisories are a userspace PV backend (the qemu-based qnic for network, qdisk for block) or a dedicated driver domain per guest (xenbits.xen.org).
    • Qubes OS classed all three as denial of service only and stated that no user action is needed on Qubes (qubes-os.org, seen in search results).

    Fix Details

    Each advisory ships a Linux kernel patch: xsa526-linux.patch, xsa527-linux.patch and xsa528-linux.patch (xenbits.xen.org). The upstream commits are a02926f7c89bfc798ee9514e09694ff4279928a1, 'xen-blkback: Avoid UAF when reading I/O statistics', for XSA-528, and bfddc420afe827d9f06458cdf8087cd602f8c9cb, 'xen-netback: defer xenvif_mcast_addr_list_free()', for XSA-527, both recorded in the Linux 6.12.116 changelog (cdn.kernel.org, seen in search results). The changelog names Juergen Gross as the signer of the XSA-528 fix, and a news report names Juergen Gross and Jan Beulich as the authors of the three fixes (linuxcompatible.org, seen in search results). The XSA-527 change defers the multicast address-list free until TX and RX processing has stopped. A batch of seven stable kernels shipped on 6 November carrying the same three fixes (fosslinux.com, seen in search results), and a third-party tracker lists 5.10.274, 5.15.225, 6.1.192, 6.6.162, 6.12.116 and 6.18.62 among the fixed branches, though its list is cut off (techveda.live, seen in search results). A downstream XCP-ng kernel pull request, #50, was opened on 7 November and merged on 9 November (github.com/xcp-ng-rpms/kernel, seen in search results). The research did not confirm the fixed release of every distribution branch, nor a pull request or commit in the upstream Linux tree for each advisory.

    Remediation

    • Inventory the Xen hosts whose Linux dom0 or driver domains run xen-netback or xen-blkback, using the advisory thresholds of Linux 4.3 and newer for XSA-527, 4.11 and newer for XSA-526 and 4.5 and newer for XSA-528 (xenbits.xen.org).
    • Install the Linux kernel release from your distribution or the stable branch that carries the three patches, and confirm the release against the distribution's own advisory, because the upstream commits were confirmed only in 6.12.116.
    • Where patching is delayed, move the network backend to a userspace PV backend or a dedicated network driver domain per guest, and the block backend to qdisk or a dedicated block driver domain (xenbits.xen.org).
    • The CERT-FR notice points to the Xen bulletins for the patches (cert.cyber.gouv.fr).

    Conflicting Reports

    The CERT-FR notice describes the flaws generically as privilege escalation, confidentiality breach and denial of service for all Xen versions without the latest fix (cert.cyber.gouv.fr). The Xen advisories narrow this: the stated impact is mainly denial of service and host crash, information leaks are possible for XSA-526 and XSA-528, privilege escalation is mentioned only for XSA-527 with very low likelihood, and the vulnerable code sits in the Linux kernel drivers rather than in the hypervisor itself (xenbits.xen.org). The vendor advisories carry more weight for impact and scope, and the Qubes OS assessment of denial of service only matches them (qubes-os.org, seen in search results).