CVE-2026-99286
Description
A flaw was found in the Linux kernel's xen-netback driver. During a virtual network connection failure, the driver deallocates queue resources before resetting the active queue count. A local user or guest domain could exploit this race condition by requesting network statistics during cleanup, causing the system to access freed memory. This issue primarily leads to a denial of service (DoS) due to a kernel crash.
Statement
This vulnerability is rated as Moderate impact because successful exploitation is confined to causing a host denial of service without compromising data confidentiality or system integrity. In default Red Hat Enterprise Linux deployments, systems do not operate as Xen backend virtualization hosts, which minimizes the attack surface. Furthermore, triggering the condition requires winning a narrow race during connection teardown while querying network device statistics from an adjacent guest domain or local user.
Mitigation
Prevent the xen-netback kernel module from being loaded by configuring modprobe:
# echo "install xen-netback /bin/true" > /etc/modprobe.d/xen-netback.conf
If the module is already loaded into the running kernel, a system reboot is required for this mitigation to take effect.
Caveat: Disabling this driver prevents the host system from providing network virtualization backend services to Xen guest domains.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.6 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Alter Execution Logic; Unexpected State
The main problem is that -- if a lock is overcome -- data could be altered in a bad state.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
