CVE-2026-100081 json
xen-netback: defer xenvif_mcast_addr_list_free()
published 2026-11-06 2 d ago modified 2026-11-06 2 d ago also EUVD-2026-118400
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
xen-netback: defer xenvif_mcast_addr_list_free()
In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()).
Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect().
This is XSA-527 / CVE-2026-100081.
Patch / fix
- Linux Linux 5.10.274, 5.15.225, 6.1.192, 6.6.162, 6.12.116, 6.18.62, 7.3.3
- linux Debian 13 6.12.116-1
debian advisories DEBIAN-CVE-2026-100081
- git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515 commit
- git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1 commit
- git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db commit
- git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c commit
- git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62 commit
- git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99 commit
- git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-100081 updated cvss 6.0
kernel: kernel: xen-netback: Denial of Service via race condition during interface disconnect
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9not affected: vulnerable code not present
+1 more productsfewer
Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9, openshift/ose-rhel-coreos-10
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).
Affected products
- Linux Linux
Classification
- Technology feeds
References
- git.kernel.org /stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515
- git.kernel.org /stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1
- git.kernel.org /stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db
- git.kernel.org /stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c
- git.kernel.org /stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62
- git.kernel.org /stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99
- git.kernel.org /stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff
- openwall.com /lists/oss-security/2026/11/06/10
- xenbits.xen.org /xsa/advisory-527.html
Sources
- CVE List CVE-2026-100081
- NVD CVE-2026-100081
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.