{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100081", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.456Z", "datePublished": "2026-11-06T18:23:02.185Z", "dateUpdated": "2026-11-06T19:08:43.050Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-06T18:23:02.185Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()'s error path doesn't require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/xen-netback/interface.c", "drivers/net/xen-netback/xenbus.c"], "versions": [{"version": "b17075d5c1988b83f840d272c795ac17d57ce804", "lessThan": "96e05a8ce243e2207704e2e7a6e7d1172730f515", "status": "affected", "versionType": "git"}, {"version": "b17075d5c1988b83f840d272c795ac17d57ce804", "lessThan": "0e786123e46d08d2247ce93a5435e45ed9f4c5d1", "status": "affected", "versionType": "git"}, {"version": "b17075d5c1988b83f840d272c795ac17d57ce804", "lessThan": "990d123d9eaa3ac6c979eed245658676d65ce0db", "status": "affected", "versionType": "git"}, {"version": "b17075d5c1988b83f840d272c795ac17d57ce804", "lessThan": "0d515c409033c8e2a645a781be3ca76ab825fc8c", "status": "affected", "versionType": "git"}, {"version": "b17075d5c1988b83f840d272c795ac17d57ce804", "lessThan": "a6bb2f1fa62c56279bdcdadce28d1310c5e12b62", "status": "affected", "versionType": "git"}, {"version": "b17075d5c1988b83f840d272c795ac17d57ce804", "lessThan": "34f0f63dc6dc11895a17bb5672451b6b11622c99", "status": "affected", "versionType": "git"}, {"version": "b17075d5c1988b83f840d272c795ac17d57ce804", "lessThan": "fb38fc58acb26d74fe8f7b19621fafaae3c040ff", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/xen-netback/interface.c", "drivers/net/xen-netback/xenbus.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.274", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.225", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.192", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.162", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.116", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.62", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.3", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.10.274"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.225"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.192"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.162"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.116"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.62"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.3.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515"}, {"url": "https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1"}, {"url": "https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db"}, {"url": "https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c"}, {"url": "https://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62"}, {"url": "https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99"}, {"url": "https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff"}], "title": "xen-netback: defer xenvif_mcast_addr_list_free()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/06/10"}, {"url": "http://xenbits.xen.org/xsa/advisory-527.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-06T19:08:43.050Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/xen-netback/interface.c", "drivers/net/xen-netback/xenbus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "96e05a8ce243e2207704e2e7a6e7d1172730f515", "status": "affected", "version": "b17075d5c1988b83f840d272c795ac17d57ce804", "versionType": "git"}, {"lessThan": "0e786123e46d08d2247ce93a5435e45ed9f4c5d1", "status": "affected", "version": "b17075d5c1988b83f840d272c795ac17d57ce804", "versionType": "git"}, {"lessThan": "990d123d9eaa3ac6c979eed245658676d65ce0db", "status": "affected", "version": "b17075d5c1988b83f840d272c795ac17d57ce804", "versionType": "git"}, {"lessThan": "0d515c409033c8e2a645a781be3ca76ab825fc8c", "status": "affected", "version": "b17075d5c1988b83f840d272c795ac17d57ce804", "versionType": "git"}, {"lessThan": "a6bb2f1fa62c56279bdcdadce28d1310c5e12b62", "status": "affected", "version": "b17075d5c1988b83f840d272c795ac17d57ce804", "versionType": "git"}, {"lessThan": "34f0f63dc6dc11895a17bb5672451b6b11622c99", "status": "affected", "version": "b17075d5c1988b83f840d272c795ac17d57ce804", "versionType": "git"}, {"lessThan": "fb38fc58acb26d74fe8f7b19621fafaae3c040ff", "status": "affected", "version": "b17075d5c1988b83f840d272c795ac17d57ce804", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/xen-netback/interface.c", "drivers/net/xen-netback/xenbus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.274", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.225", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.192", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.162", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.116", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.62", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.3", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()'s error path doesn't require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081."}], "id": "CVE-2026-100081", "lastModified": "2026-11-06T19:17:03.373", "metrics": {}, "published": "2026-11-06T19:17:03.373", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/06/10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://xenbits.xen.org/xsa/advisory-527.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: xen-netback: Denial of Service via race condition during interface disconnect", "id": "2568425", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568425"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["A flaw was found in the Linux kernel's Xen network backend (xen-netback) driver. A race condition occurs during network interface disconnection when multicast address memory is freed before active network packet processing has completely stopped. A malicious guest virtual machine can exploit this vulnerability to cause a Denial of Service (DoS) via a host system crash or potentially execute arbitrary code on the host."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent the xen-netback kernel module from being loaded if Xen network backend services are not required:\n1. Add a configuration rule to block loading of the module:\n```\necho \"install xen-netback /bin/true\" > /etc/modprobe.d/xen-netback.conf\n```\n2. If the module is currently loaded, attempt to unload it:\n```\nmodprobe -r xen-netback\n```\nIf the module is actively in use or cannot be unloaded, a system reboot is required for changes to take effect.\nWarning / Caveat: Disabling the xen-netback module disables Xen network backend support and will disconnect network interfaces for any Xen guest domains running on the host."}, "name": "CVE-2026-100081", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-06T18:23:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-100081\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100081\nhttps://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c\nhttps://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1\nhttps://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99\nhttps://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515\nhttps://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db\nhttps://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62\nhttps://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff"], "statement": "This vulnerability is rated as Moderate because triggering the race condition requires a paravirtualized guest on a Xen host during virtual interface teardown, primarily resulting in a host denial of service. Standard Red Hat Enterprise Linux environments do not deploy as Xen Dom0 hosts, so the affected driver is inactive in typical default configurations. Exposure is confined to specialized architectures where the system explicitly functions as a Xen network backend domain.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,96e05a8ce243e2207704e2e7a6e7d1172730f515)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,0e786123e46d08d2247ce93a5435e45ed9f4c5d1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,990d123d9eaa3ac6c979eed245658676d65ce0db)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,0d515c409033c8e2a645a781be3ca76ab825fc8c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,a6bb2f1fa62c56279bdcdadce28d1310c5e12b62)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,34f0f63dc6dc11895a17bb5672451b6b11622c99)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,fb38fc58acb26d74fe8f7b19621fafaae3c040ff)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "calver", "value": "4.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.274,6.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.225,6.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.192,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.162,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.116,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.62,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.3,8.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,96e05a8ce243e2207704e2e7a6e7d1172730f515)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,0e786123e46d08d2247ce93a5435e45ed9f4c5d1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,990d123d9eaa3ac6c979eed245658676d65ce0db)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,0d515c409033c8e2a645a781be3ca76ab825fc8c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,a6bb2f1fa62c56279bdcdadce28d1310c5e12b62)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,34f0f63dc6dc11895a17bb5672451b6b11622c99)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b17075d5c1988b83f840d272c795ac17d57ce804,fb38fc58acb26d74fe8f7b19621fafaae3c040ff)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "calver", "value": "4.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.274,6.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.225,6.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.192,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.162,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.116,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.62,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.3,8.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-06T19:45:08.007728+00:00", "updated": "2026-11-08T03:30:15.789823+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}