The Morning Dev

Only the news worth knowing

‹
 
C21/100

Vulnerability · medium

Xen use-after-free flaws in xen-blkback and xen-netback fixed in Xen Security Advisories 526-528 and Linux stable kernels

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Xen hosts using Linux xen-netback with guests reading network statistics

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

The Brief

  • Xen Security Advisory 526 (XSA-526, CVE-2026-100080) concerns the Linux xen-netback driver.
  • A guest can trigger a use-after-free when reading network statistics, although the driver protects this data with RCU.

Why it matters

Operators running Xen with Linux xen-netback backends should check whether their hosts are affected and apply the fix from the advisory once it is available to them.

The checklist behind the tier

Checklist · 1 of 10 yes
YesHits tech teamsJudgment: Linux xen-netback driver runs on Xen-based servers and hosts that ops teams manage.
NoCore infrastructureJudgment: a Xen-specific network backend driver, not core software nearly every team runs.
NoPopular toolJudgment: Xen is a niche hypervisor backend component, not a mainstream developer tool.
NoExploited in the wildOpen Source Security: advisory only describes the flaw; no observed attacks reported.
NoPublic exploitOpen Source Security: advisory text shows no published exploit or proof-of-concept.
NoRemote, no loginOpen Source Security: the advisory says a guest triggers the flaw, so guest access is needed.
NoFull takeoverOpen Source Security: described as a use-after-free on statistics reads; no code execution stated.
NoSecrets exposedOpen Source Security: no data theft or exposure reported in the source.
NoSupply chainOpen Source Security: a normal driver bug in legitimate code, not a supply chain compromise.
NoNo fix yetOpen Source Security: source excerpt does not say a fix is missing; no lack of patch reported.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-100080 ↗

    xen-netback: Fix UAF when reading statistics data

    Exploited
    Not in CISA’s exploited catalog

    NVD

  • CVE-2026-100082 ↗

    xen-blkback: Avoid UAF when reading I/O statistics

    Exploited
    Not in CISA’s exploited catalog

    NVD

  • CVE-2026-100081 ↗

    xen-netback: defer xenvif_mcast_addr_list_free()

    Exploited
    Not in CISA’s exploited catalog

    NVD

Timeline

  1. Xen Security Advisory 526 published on oss-security

  2. Open Source Security

    Xen Security Advisory 526 v1 (CVE-2026-100080) - Linux xen-netback: guest can trigger use-after-free for

  3. Open Source Security

    Xen Security Advisory 527 v1 (CVE-2026-100081) - Linux xen-netback: guest can trigger use-after-free for reading multicast data

  4. Open Source Security

    Xen Security Advisory 528 v1 (CVE-2026-100082) - Linux xen-blkback: guest can trigger use-after-free for reading statistic data

  5. LWN.net

    Seven stable kernels with fixes for three Xen vulnerabilities

Full coverage · 4 sources

First seen · 4 sources · Full story page · How tiers are decided