Linux xen-netback: guest can trigger double unmap of memory (CVE-2026-99287)
A vulnerability in the Linux xen-netback driver allows a guest to trigger a double unmap of memory during connection setup due to a missing test when handling illegal ring index values.
CVE search metadata
CVE search record: CVE-2026-99287. KEV: no. Product: Linux xen-netback. Brief: Linux xen-netback: guest can trigger double unmap of memory (CVE-2026-99287). Brief link: https://feed.craftedsignal.io/briefs/2026-11-xen-netback-double-unmap/
Triage facts
Revision 1- Applicability
- Linux xen-netback
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 11, 03:39 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
The Xen Security Advisory XSA-532 (CVE-2026-99287) identifies an issue in the Linux xen-netback driver. During the connection setup to a frontend, the backend maps ring pages and validates their contents. If the ring index values are illegal, the driver attempts to unmap all allocated resources; however, a missing test during this cleanup process allows a guest to trigger a double unmap of memory.