VulnerabilityPublished 6 Nov 2026

CVE-2026-100081: Linux kernel · xen-netback: defer xenvif_mcast_addr_list_free()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in fb38fc58acb26d74fe8f7b19621fafaae3c040ff : update Linux kernel when convenient.

Data as of 6 Nov 2026, 18:35 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in fb38fc58acb26d74fe8f7b19621fafaae3c040ff, a6bb2f1fa62c56279bdcdadce28d1310c5e12b62, 990d123d9eaa3ac6c979eed245658676d65ce0db +4

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < fb38fc58acb26d74fe8f7b19621fafaae3c040ff	Fixed in fb38fc58acb26d74fe8f7b19621fafaae3c040ff
LinuxLinux	Affected ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < a6bb2f1fa62c56279bdcdadce28d1310c5e12b62	Fixed in a6bb2f1fa62c56279bdcdadce28d1310c5e12b62
LinuxLinux	Affected ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < 990d123d9eaa3ac6c979eed245658676d65ce0db	Fixed in 990d123d9eaa3ac6c979eed245658676d65ce0db
LinuxLinux	Affected ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < 96e05a8ce243e2207704e2e7a6e7d1172730f515	Fixed in 96e05a8ce243e2207704e2e7a6e7d1172730f515
LinuxLinux	Affected ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < 34f0f63dc6dc11895a17bb5672451b6b11622c99	Fixed in 34f0f63dc6dc11895a17bb5672451b6b11622c99
LinuxLinux	Affected ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < 0e786123e46d08d2247ce93a5435e45ed9f4c5d1	Fixed in 0e786123e46d08d2247ce93a5435e45ed9f4c5d1

AI-suggested

A fix is available and has been applied in specific Linux kernel commits. Users should update to a Linux kernel version that includes these fixes to resolve the vulnerability. Since this is a kernel-level fix, applying the updated kernel is the recommended remediation.

Description

CVE-2026-100081 is a vulnerability in the Linux kernel's xen-netback component related to the timing of the xenvif_mcast_addr_list_free() function call. The function was previously called prematurely during disconnect, which could cause synchronization issues. The fix defers this call until after all transmit and receive processing has stopped, ensuring proper synchronization and avoiding locking or RCU issues. This vulnerability is identified as XSA-527 and has been resolved in specific Linux kernel commits.

Impact

The vulnerability could lead to synchronization issues in the xen-netback driver, potentially causing race conditions or use-after-free errors during network interface disconnect operations. This could affect the stability or security of the Linux kernel when using xen-netback networking. However, no public exploits or in-the-wild exploitation are known.

Summary

The vulnerability in the Linux kernel xen-netback driver involves improper timing of the xenvif_mcast_addr_list_free() function call. Originally, this function was called within xenvif_disconnect_data(), which could lead to synchronization problems because lookups and modifications to multicast address lists occur concurrently in different contexts (xenvif_start_xmit() and xenvif_tx_action()). The fix moves the call to after the synchronization point in backend_disconnect(), ensuring that all TX/RX processing has finished before freeing the multicast address list. This correction prevents potential race conditions or use-after-free scenarios in the xen-netback backend driver. The issue is tracked as XSA-527 / CVE-2026-100081 and fixed in multiple Linux kernel commits.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 18:35 UTC

Technical details

References

Community reviews

Related threats