SecurityFan score 20 · Tier C
Xen Security Advisory 528 v1 (CVE-2026-100082) - Linux xen-blkback: guest can trigger use-after-free for reading statistic data
The Brief
- Xen Security Advisory 528 (CVE-2026-100082) covers a use-after-free in Linux xen-blkback.
- A guest can trigger the bug by reading device I/O statistics, because the driver does not serialise those reads against concurrent changes.
- The advisory was posted on Nov 06, 2026 by the Xen security team.
Why it matters
Xen hosts running Linux guests with xen-blkback may be exposed to a guest-triggered use-after-free, which can destabilise the host or be abused further.
Who’s affected
- Operators of Xen hypervisors running Linux guests with xen-blkback
- CVE-2026-100082
- #xen
- #security
- #use-after-free
- #linux
- #virtualization
- #xen-blkback
Posted by Xen . org security team on Nov 06 Xen Security Advisory CVE-2026-100082 / XSA-528 Linux xen-blkback: guest can trigger use-after-free for reading statistic data ISSUE DESCRIPTION ================= he driver does not serialise reads of the device I/O statistics against…
Timeline
Xen Security Advisory XSA-528 published
Open Source Security
Xen Security Advisory 528 v1 (CVE-2026-100082) - Linux xen-blkback: guest can trigger use-after-free for reading statistic data