medium
advisory
Xen: Linux xen-netback use-after-free in network statistics (CVE-2026-99286)
A use-after-free vulnerability in the Linux xen-netback driver exists due to missing RCU synchronization during queue teardown.
CVE search metadata
CVE search record: CVE-2026-99286. KEV: no. Product: xen-netback (kernel driver). Brief: Xen: Linux xen-netback use-after-free in network statistics (CVE-2026-99286). Brief link: https://feed.craftedsignal.io/briefs/2026-11-xen-netback-uaf/
Triage facts
Revision 1- Applicability
- xen-netback (kernel driver)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 21:35 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1
The Linux xen-netback driver contains a use-after-free vulnerability (CVE-2026-99286) related to network statistics. The issue occurs when tearing down queues after an error during connection to the frontend - such as illegal Xenstore data provided by a guest - due to missing RCU synchronization before freeing the network statistics data.