VulnerabilityPublished 6 Nov 2026

CVE-2026-100080: Linux kernel · xen-netback: Fix UAF when reading statistics data

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ab9cdf1291be551da999510b30216a2886074d7a : update Linux kernel when convenient.

Data as of 6 Nov 2026, 19:19 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in ab9cdf1291be551da999510b30216a2886074d7a, 4867687b6ad28ab84bc0811d8f8f9972e769da02, 4223b33be49ee09acb6f1d26beb4a36dd3b8d63a +11

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected <5.10.274 <5.15.225 <6.1.192 <6.6.162 <6.12.116 <6.18.62 <7.3.3	Fixed in ab9cdf1291be551da999510b30216a2886074d7a 4867687b6ad28ab84bc0811d8f8f9972e769da02 4223b33be49ee09acb6f1d26beb4a36dd3b8d63a 89e534265b62c94749639350200b10370564bb3a 37d5a73170579b30e67cc8b19ec69715eea3a6b6 36f858f228e3f955b9336af7f94634747c221518 7.3.3 6cd611d2abdd8623a554e14145f82c1cb4e4467a 6.18.62 6.12.116 6.6.162 6.1.192 5.15.225 5.10.274
Debiandebian/linux`pkg:deb/debian/linux`Other threats	Affected <5.10.274 <5.15.225 <6.1.192 <6.6.162 <6.12.116 <6.18.62 <7.3.3	Fixed in 5.10.274 5.15.225 6.1.192 6.6.162 6.12.116 6.18.62 7.3.3

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The vulnerability is fixed in Linux kernel versions 7.3.3, 6.18.62, 6.12.116, 6.6.162, 6.1.192, 5.15.225, and 5.10.274. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated.

Description

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix UAF when reading statistics data The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.g. due to illegal Xenstore data filled in by the guest), the statistic data is being freed without synchronizing the RCU state. In case the data is being read via sysfs in this phase, access to already freed memory or memory being in new use is possible. Fix that by calling synchronize_net() before freeing the queue data. This is XSA-526 / CVE-2026-100080

Impact

This vulnerability could allow access to freed or repurposed memory when reading network statistics, potentially causing kernel memory corruption or crashes. There is no indication of remote code execution or privilege escalation in the provided data.

Summary

CVE-2026-100080 addresses a use-after-free vulnerability in the Linux kernel's xen-netback driver. The network statistics data is protected by RCU, but during error handling in queue teardown (e.g., due to invalid Xenstore data from the guest), the statistics data is freed without synchronizing the RCU state. If the data is accessed via sysfs during this phase, it can lead to use-after-free conditions. The fix involves invoking synchronize_net() before freeing the queue data to ensure proper synchronization.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 18:35 UTC

Technical details

References

Community reviews

Related threats