{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:08:43.050Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/06/10"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-527.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netback/interface.c",
            "drivers/net/xen-netback/xenbus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96e05a8ce243e2207704e2e7a6e7d1172730f515",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "0e786123e46d08d2247ce93a5435e45ed9f4c5d1",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "990d123d9eaa3ac6c979eed245658676d65ce0db",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "0d515c409033c8e2a645a781be3ca76ab825fc8c",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "a6bb2f1fa62c56279bdcdadce28d1310c5e12b62",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "34f0f63dc6dc11895a17bb5672451b6b11622c99",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "fb38fc58acb26d74fe8f7b19621fafaae3c040ff",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netback/interface.c",
            "drivers/net/xen-netback/xenbus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.225",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.116",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.62",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.274",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.225",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.192",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.162",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.116",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.62",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()\u0027s error path doesn\u0027t require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The guest reaches the free by changing xenbus state: frontend_changed() calls set_backend_state(), which from XenbusStateConnected calls backend_disconnect() and xenvif_disconnect_data(), where xenvif_mcast_addr_list_free() ran before synchronize_net(). The raced lookup is xenvif_mcast_match() inside xenvif_start_xmit(); the trigger is that xenbus write, not a routable packet field.\nAC:H - xenvif_mcast_match() runs only when xenvif_start_xmit() has already seen VIF_STATUS_CONNECTED and a live queue-\u003etask, but xenvif_mcast_addr_list_free() runs only after xenvif_carrier_off() clears that bit and xenvif_disconnect_queue() returns from kthread_stop(). The lookup does not sleep, so it must be stalled across that teardown; MCAST_ADD plus Closing does not create that stall, and napi_disable() has already finished xenvif_tx_action().\nPR:L - frontend_changed() is the vif backend otherend_changed callback and accepts any connected frontend. The attacker must control that guest\u0027s xenstore frontend state and TX ring, i.e. the guest kernel; a host user namespace has no path to this xenbus backend.\nUI:N - The guest writes its own request-multicast-control key, queues XEN_NETIF_EXTRA_TYPE_MCAST_ADD on the TX ring, and sets the frontend xenbus state to Closing. The host operator does not have to mount media, open a device, or acknowledge a prompt.\nS:C - The use-after-free is in dom0 xen-netback: xenvif_mcast_match() dereferences vif-\u003efe_mcast_addr nodes freed by xenvif_mcast_addr_list_free(). A guest that wins the race crashes or corrupts that backend kernel, crossing the Xen guest-to-host boundary.\nC:H - xenvif_mcast_match() walks fe_mcast_addr under rcu_read_lock() via list_for_each_entry_rcu() and ether_addr_equal() on mcast-\u003eaddr, while xenvif_mcast_addr_list_free() kfree()s those xenvif_mcast_addr nodes with no grace period. A reused node lets the walk follow next pointers into other kernel memory.\nI:H - The freed objects are slab allocations from kzalloc_obj() in xenvif_mcast_add(). xenvif_mcast_match() can still dereference them after kfree() in xenvif_mcast_addr_list_free(), a heap use-after-free in the backend rather than a NULL deref, and XSA-527 treats host privilege escalation from that race as possible.\nA:H - A list walk in xenvif_mcast_match() that follows an fe_mcast_addr node already passed to kfree() by xenvif_mcast_addr_list_free() oopses the backend kernel. XSA-527 describes that fault as a driver crash that can take down the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:57:39.730Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62"
        },
        {
          "url": "https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff"
        }
      ],
      "title": "xen-netback: defer xenvif_mcast_addr_list_free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-100081",
    "datePublished": "2026-11-06T18:23:02.185Z",
    "dateReserved": "2026-09-25T10:25:14.456Z",
    "dateUpdated": "2026-11-10T16:57:39.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}