Vulnerability · medium
Xen Security Advisory 528: xen-blkback use-after-free reading statistics
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Xen hosts running Linux guests with xen-blkback
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
The Brief
- Xen Security Advisory 528 (CVE-2026-100082) covers a use-after-free in Linux xen-blkback.
- A guest can trigger the bug by reading device I/O statistics, because the driver does not serialise those reads against concurrent changes.
- The advisory was posted on Nov 06, 2026 by the Xen security team.
Why it matters
Xen hosts running Linux guests with xen-blkback may be exposed to a guest-triggered use-after-free, which can destabilise the host or be abused further.
The checklist behind the tier
Checklist · 1 of 10 yes
| Yes | Hits tech teams | Judgment: Xen hypervisor's Linux block backend is run by virtualization and cloud ops teams. |
| No | Core infrastructure | Judgment: niche Xen block-backend driver, not kernel core or a tool nearly every team runs. |
| No | Popular tool | Judgment: Xen block backend driver is a specialized virtualization component, not a mainstream developer tool. |
| No | Exploited in the wild | Open Source Security advisory describes a use-after-free; no source reports observed attacks. |
| No | Public exploit | Open Source Security advisory only; no source says exploit code or a PoC is published. |
| No | Remote, no login | Open Source Security: a guest triggers the flaw, so an existing guest VM is needed, not unauthenticated network access. |
| No | Full takeover | Open Source Security describes a guest-triggered use-after-free; no source reports code execution or root. |
| No | Secrets exposed | Open Source Security describes a use-after-free for statistics; no source reports data theft or exposure. |
| No | Supply chain | Open Source Security describes a normal driver bug; no source reports compromised packages or updates. |
| No | No fix yet | Open Source Security excerpt does not state a fix status; no source says no patch exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Xen Security Advisory XSA-528 published
Open Source Security
Xen Security Advisory 528 v1 (CVE-2026-100082) - Linux xen-blkback: guest can trigger use-after-free for reading statistic data
Source
Xen Security Advisory 528 v1 (CVE-2026-100082) - Linux xen-blkback: guest can trigger use-after-free for reading statistic data ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided