SecurityFan score 20 · Tier C
Xen Security Advisory 527 v1 (CVE-2026-100081) - Linux xen-netback: guest can trigger use-after-free for reading multicast data
The Brief
- Xen Security Advisory 527 (XSA-527, CVE-2026-100081) was published on 2026-11-06.
- The Linux xen-netback driver can be made to perform a use-after-free when handling multicast data.
- A guest can trigger the flaw, which lets it read multicast data.
Why it matters
Operators of Xen hosts running Linux with the xen-netback driver should check whether they are affected and apply the fix from the advisory, since a guest VM can trigger the bug.
Who’s affected
- Operators of Xen hosts running Linux with xen-netback
- CVE-2026-100081
- #xen
- #linux
- #security
- #vulnerability
- #use-after-free
- #kernel
Posted by Xen . org security team on Nov 06 Xen Security Advisory CVE-2026-100081 / XSA-527 Linux xen-netback: guest can trigger use-after-free for reading multicast data ISSUE DESCRIPTION ================= Multicast handling in the driver is implemented as a lookup early on the…