Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-11-10T18:16:53 kernel: kernel: xen-netback: Denial of Service via race condition during connection cleanup 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H CWE-366

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues under rcu_read_lock. We need to unpublish vif->num_queues before synchronize_net to ensure that readers that come afterwards will not read a non-zero vif->num_queues and attempt to access invalid queues. This is the same cleanup algorithm as used in backend_disconnect and added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect"). This is XSA-531

A flaw was found in the Linux kernel's xen-netback driver. During a virtual network connection failure, the driver deallocates queue resources before resetting the active queue count. A local user or guest domain could exploit this race condition by requesting network statistics during cleanup, causing the system to access freed memory. This issue primarily leads to a denial of service (DoS) due to a kernel crash.

This vulnerability is rated as Moderate impact because successful exploitation is confined to causing a host denial of service without compromising data confidentiality or system integrity. In default Red Hat Enterprise Linux deployments, systems do not operate as Xen backend virtualization hosts, which minimizes the attack surface. Furthermore, triggering the condition requires winning a narrow race during connection teardown while querying network device statistics from an adjacent guest domain or local user. Prevent the xen-netback kernel module from being loaded by configuring modprobe: # echo "install xen-netback /bin/true" > /etc/modprobe.d/xen-netback.conf If the module is already loaded into the running kernel, a system reboot is required for this mitigation to take effect. Caveat: Disabling this driver prevents the host system from providing network virtualization backend services to Xen guest domains. Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-10 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-99286 https://nvd.nist.gov/vuln/detail/CVE-2026-99286 https://git.kernel.org/stable/c/07aca7d25ce8578fedde49855983a01c537a782b https://git.kernel.org/stable/c/a97aa838903d15f865d80809f5198ff459c6634a https://git.kernel.org/stable/c/ade3082dcdee17c5767069883936d64ff83f6c9f