EN PT-BR
← Voltar ao feed
medium

Xen security advisories XSA-526, XSA-527 and XSA-528: use-after-free flaws in Linux xen-netback and xen-blkback drivers

1 fonte(s) · 1 atualização(ões) · publicado 08/11/2026 21:00 · coletado há 1 hora

The Xen Project published three security advisories on 6 November 2026, XSA-526, XSA-527 and XSA-528, which the CERT-FR notice relays under CVE-2026-100080, CVE-2026-100081 and CVE-2026-100082. All three are use-after-free conditions in the Linux kernel backends that serve Xen guests, xen-netback (network) and xen-blkback (block), and they appear while a device is being torn down. The advisories describe the trigger as coming from a guest, so the threat sits with a tenant or compromised guest on the host rather than with an external network attacker (xenbits.xen.org). The vendor expects a driver or host crash, making denial of service the main outcome, and information leaks cannot be ruled out for XSA-526 and XSA-528 (xenbits.xen.org). The research found no exploitation report and the advisories opened do not state a CVSS score, so the urgency is medium.

Entenda a falha

A vulnerabilidade

Three use-after-free flaws in the Linux kernel backends that serve Xen guests, not in the hypervisor itself: CVE-2026-100080 (XSA-526, xen-netback, Linux 4.11 and newer), CVE-2026-100081 (XSA-527, xen-netback, Linux 4.3 and newer) and CVE-2026-100082 (XSA-528, xen-blkback, Linux 4.5 and newer). The trigger comes from a guest, so the attacker is a tenant or compromised guest, not an external network attacker. The expected impact is a driver or host crash (denial of service). Information leaks cannot be ruled out for XSA-526 and XSA-528, and the advisories mention privilege escalation only for XSA-527, with very low likelihood. No CVSS score was stated. Fixes are kernel patches; the upstream commits were confirmed in Linux 6.12.116, and other branches should be checked against the distribution's advisory.

Como funciona

In all three cases the problem shows up while a virtual device is being torn down. For XSA-526, the per-queue statistics of xen-netback are read under RCU protection, but if the queues are removed after an error while the frontend connects (for example after illegal Xenstore data written by the guest), the memory is freed without waiting for RCU readers, so a sysfs read in that window touches freed memory. For XSA-527, the multicast lookup on the guest-receive transmit path can run in parallel with teardown and read freed data. For XSA-528, xen-blkback reads I/O statistics while that memory is being freed, with nothing ordering the two.

Por que é vulnerável

The root cause is missing synchronization between code that reads driver data and code that frees it during teardown. In XSA-526 the free skips an RCU synchronization; in XSA-528 the statistics read is not serialized against the free; in XSA-527 the multicast address list can be freed while TX and RX processing is still running. The XSA-527 fix defers the multicast address-list free until TX and RX processing has stopped. The articles do not explain why the bugs went unnoticed for years.

Onde está

The affected code is in the Linux xen-netback and xen-blkback drivers; the upstream fix commits are bfddc420afe827d9f06458cdf8087cd602f8c9cb ('xen-netback: defer xenvif_mcast_addr_list_free()', XSA-527) and a02926f7c89bfc798ee9514e09694ff4279928a1 ('xen-blkback: Avoid UAF when reading I/O statistics', XSA-528), and the advisories ship xsa526-linux.patch, xsa527-linux.patch and xsa528-linux.patch.

Como foi descoberta

The Xen advisories credit Yehyeong Lee of Hyundai Mobis for XSA-526 and XSA-528, and kerhunt for XSA-527. The Xen Project published all three on 6 November 2026, and CERT-FR relayed them on 9 November under CVE-2026-100080, CVE-2026-100081 and CVE-2026-100082. The research found no report of exploitation. A news report names Juergen Gross and Jan Beulich as authors of the fixes. The articles do not say how the researchers found the bugs.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 14:30.

Detalhes técnicos

  • XSA-526 / CVE-2026-100080: the per-queue statistics of xen-netback are protected by RCU, but when queues are torn down after an error during frontend connection (for example after illegal Xenstore data written by the guest), the memory is freed without an RCU synchronization, so a sysfs read in that window touches freed memory. Linux 4.11 and newer are affected (xenbits.xen.org). The advisory credits Yehyeong Lee of Hyundai Mobis (xenbits.xen.org).
  • XSA-527 / CVE-2026-100081: the multicast lookup on the guest-receive transmit path can run in parallel with device teardown and read freed data. Linux 4.3 and newer are affected, and the advisory credits kerhunt (xenbits.xen.org).
  • XSA-528 / CVE-2026-100082: xen-blkback reads I/O statistics without serializing them against the freeing of that memory, which causes a use-after-free during teardown. Linux 4.5 and newer are affected, and the advisory credits Yehyeong Lee (xenbits.xen.org).
  • Mitigations named by the advisories are a userspace PV backend (the qemu-based qnic for network, qdisk for block) or a dedicated driver domain per guest (xenbits.xen.org).
  • Qubes OS classed all three as denial of service only and stated that no user action is needed on Qubes (qubes-os.org, seen in search results).

Detalhes da correção

Each advisory ships a Linux kernel patch: xsa526-linux.patch, xsa527-linux.patch and xsa528-linux.patch (xenbits.xen.org). The upstream commits are a02926f7c89bfc798ee9514e09694ff4279928a1, 'xen-blkback: Avoid UAF when reading I/O statistics', for XSA-528, and bfddc420afe827d9f06458cdf8087cd602f8c9cb, 'xen-netback: defer xenvif_mcast_addr_list_free()', for XSA-527, both recorded in the Linux 6.12.116 changelog (cdn.kernel.org, seen in search results). The changelog names Juergen Gross as the signer of the XSA-528 fix, and a news report names Juergen Gross and Jan Beulich as the authors of the three fixes (linuxcompatible.org, seen in search results). The XSA-527 change defers the multicast address-list free until TX and RX processing has stopped. A batch of seven stable kernels shipped on 6 November carrying the same three fixes (fosslinux.com, seen in search results), and a third-party tracker lists 5.10.274, 5.15.225, 6.1.192, 6.6.162, 6.12.116 and 6.18.62 among the fixed branches, though its list is cut off (techveda.live, seen in search results). A downstream XCP-ng kernel pull request, #50, was opened on 7 November and merged on 9 November (github.com/xcp-ng-rpms/kernel, seen in search results). The research did not confirm the fixed release of every distribution branch, nor a pull request or commit in the upstream Linux tree for each advisory.

Remediação

  • Inventory the Xen hosts whose Linux dom0 or driver domains run xen-netback or xen-blkback, using the advisory thresholds of Linux 4.3 and newer for XSA-527, 4.11 and newer for XSA-526 and 4.5 and newer for XSA-528 (xenbits.xen.org).
  • Install the Linux kernel release from your distribution or the stable branch that carries the three patches, and confirm the release against the distribution's own advisory, because the upstream commits were confirmed only in 6.12.116.
  • Where patching is delayed, move the network backend to a userspace PV backend or a dedicated network driver domain per guest, and the block backend to qdisk or a dedicated block driver domain (xenbits.xen.org).
  • The CERT-FR notice points to the Xen bulletins for the patches (cert.cyber.gouv.fr).

Relatos divergentes

The CERT-FR notice describes the flaws generically as privilege escalation, confidentiality breach and denial of service for all Xen versions without the latest fix (cert.cyber.gouv.fr). The Xen advisories narrow this: the stated impact is mainly denial of service and host crash, information leaks are possible for XSA-526 and XSA-528, privilege escalation is mentioned only for XSA-527 with very low likelihood, and the vulnerable code sits in the Linux kernel drivers rather than in the hypervisor itself (xenbits.xen.org). The vendor advisories carry more weight for impact and scope, and the Qubes OS assessment of denial of service only matches them (qubes-os.org, seen in search results).

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 08/11/2026 21:00 · coletado 09/11 14:01 primeiro registro

    Xen security advisories XSA-526, XSA-527 and XSA-528: use-after-free flaws in Linux xen-netback and xen-blkback drivers

    ler a análise desta fonte

    The Xen Project published three security advisories on 6 November 2026, XSA-526, XSA-527 and XSA-528, which the CERT-FR notice relays under CVE-2026-100080, CVE-2026-100081 and CVE-2026-100082. All three are use-after-free conditions in the Linux kernel backends that serve Xen guests, xen-netback (network) and xen-blkback (block), and they appear while a device is being torn down. The advisories describe the trigger as coming from a guest, so the threat sits with a tenant or compromised guest on the host rather than with an external network attacker (xenbits.xen.org). The vendor expects a driver or host crash, making denial of service the main outcome, and information leaks cannot be ruled out for XSA-526 and XSA-528 (xenbits.xen.org). The research found no exploitation report and the advisories opened do not state a CVSS score, so the urgency is medium.

    Technical Details

    • XSA-526 / CVE-2026-100080: the per-queue statistics of xen-netback are protected by RCU, but when queues are torn down after an error during frontend connection (for example after illegal Xenstore data written by the guest), the memory is freed without an RCU synchronization, so a sysfs read in that window touches freed memory. Linux 4.11 and newer are affected (xenbits.xen.org). The advisory credits Yehyeong Lee of Hyundai Mobis (xenbits.xen.org).
    • XSA-527 / CVE-2026-100081: the multicast lookup on the guest-receive transmit path can run in parallel with device teardown and read freed data. Linux 4.3 and newer are affected, and the advisory credits kerhunt (xenbits.xen.org).
    • XSA-528 / CVE-2026-100082: xen-blkback reads I/O statistics without serializing them against the freeing of that memory, which causes a use-after-free during teardown. Linux 4.5 and newer are affected, and the advisory credits Yehyeong Lee (xenbits.xen.org).
    • Mitigations named by the advisories are a userspace PV backend (the qemu-based qnic for network, qdisk for block) or a dedicated driver domain per guest (xenbits.xen.org).
    • Qubes OS classed all three as denial of service only and stated that no user action is needed on Qubes (qubes-os.org, seen in search results).

    Fix Details

    Each advisory ships a Linux kernel patch: xsa526-linux.patch, xsa527-linux.patch and xsa528-linux.patch (xenbits.xen.org). The upstream commits are a02926f7c89bfc798ee9514e09694ff4279928a1, 'xen-blkback: Avoid UAF when reading I/O statistics', for XSA-528, and bfddc420afe827d9f06458cdf8087cd602f8c9cb, 'xen-netback: defer xenvif_mcast_addr_list_free()', for XSA-527, both recorded in the Linux 6.12.116 changelog (cdn.kernel.org, seen in search results). The changelog names Juergen Gross as the signer of the XSA-528 fix, and a news report names Juergen Gross and Jan Beulich as the authors of the three fixes (linuxcompatible.org, seen in search results). The XSA-527 change defers the multicast address-list free until TX and RX processing has stopped. A batch of seven stable kernels shipped on 6 November carrying the same three fixes (fosslinux.com, seen in search results), and a third-party tracker lists 5.10.274, 5.15.225, 6.1.192, 6.6.162, 6.12.116 and 6.18.62 among the fixed branches, though its list is cut off (techveda.live, seen in search results). A downstream XCP-ng kernel pull request, #50, was opened on 7 November and merged on 9 November (github.com/xcp-ng-rpms/kernel, seen in search results). The research did not confirm the fixed release of every distribution branch, nor a pull request or commit in the upstream Linux tree for each advisory.

    Remediation

    • Inventory the Xen hosts whose Linux dom0 or driver domains run xen-netback or xen-blkback, using the advisory thresholds of Linux 4.3 and newer for XSA-527, 4.11 and newer for XSA-526 and 4.5 and newer for XSA-528 (xenbits.xen.org).
    • Install the Linux kernel release from your distribution or the stable branch that carries the three patches, and confirm the release against the distribution's own advisory, because the upstream commits were confirmed only in 6.12.116.
    • Where patching is delayed, move the network backend to a userspace PV backend or a dedicated network driver domain per guest, and the block backend to qdisk or a dedicated block driver domain (xenbits.xen.org).
    • The CERT-FR notice points to the Xen bulletins for the patches (cert.cyber.gouv.fr).

    Conflicting Reports

    The CERT-FR notice describes the flaws generically as privilege escalation, confidentiality breach and denial of service for all Xen versions without the latest fix (cert.cyber.gouv.fr). The Xen advisories narrow this: the stated impact is mainly denial of service and host crash, information leaks are possible for XSA-526 and XSA-528, privilege escalation is mentioned only for XSA-527 with very low likelihood, and the vulnerable code sits in the Linux kernel drivers rather than in the hypervisor itself (xenbits.xen.org). The vendor advisories carry more weight for impact and scope, and the Qubes OS assessment of denial of service only matches them (qubes-os.org, seen in search results).