Xen Security Advisory 527: xen-netback use-after-free reading multicast data

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Xen hosts running Linux with the xen-netback driver

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

CVE-2026-100081 ↗

The Brief

Xen Security Advisory 527 (XSA-527, CVE-2026-100081) was published on 2026-11-06.
The Linux xen-netback driver can be made to perform a use-after-free when handling multicast data.
A guest can trigger the flaw, which lets it read multicast data.

Why it matters

Operators of Xen hosts running Linux with the xen-netback driver should check whether they are affected and apply the fix from the advisory, since a guest VM can trigger the bug.

The checklist behind the tier

Checklist · 1 of 10 yes

Yes	Hits tech teams	Xen hypervisor drivers run on servers and cloud hosts that IT and ops teams operate.
No	Core infrastructure	A niche Xen netback driver inside the Linux kernel, not the kernel-wide core affected.
No	Popular tool	Xen is used in some virtualization setups, but this netback driver flaw is niche.
No	Exploited in the wild	Oss-security advisory (seclists.org, 2026-11-06) describes a flaw only; no observed attacks reported.
No	Public exploit	Open Source Security advisory post gives no exploit code or PoC; only an advisory exists.
No	Remote, no login	Open Source Security advisory says a guest must trigger it, so it needs a guest VM, not unauthenticated network access.
No	Full takeover	Open Source Security advisory describes reading multicast data; no code execution or root access stated.
No	Secrets exposed	Open Source Security advisory describes a read flaw; no stolen or exposed secrets reported.
No	Supply chain	Open Source Security advisory describes a driver bug; no malicious code shipped through trusted channels.
No	No fix yet	Open Source Security advisory gives no statement that a fix is missing or incomplete; no fix status reported.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

CVE-2026-100081 ↗
Exploited
Not in CISA’s exploited catalog
NVD

Timeline

Nov 6
Xen Security Advisory 527 published
Nov 6 · 4:45 PM
Open Source Security
Xen Security Advisory 527 v1 (CVE-2026-100081) - Linux xen-netback: guest can trigger use-after-free for reading multicast data

Source

Xen Security Advisory 527 v1 (CVE-2026-100081) - Linux xen-netback: guest can trigger use-after-free for reading multicast data ↗ Open Source Security · 2h ago

First seen 2h ago · 1 source · Full story page · How tiers are decided