Linux xen-netback: multicast list freed during disconnect while TX/RX processing may still use it (XSA-527)

Impact

The Xen network backend driver in the dom0 or driver-domain kernel freed a guest's multicast address list without locking or RCU while transmit and receive processing could still be looking it up or changing it. This is a race that can lead to use of freed memory in the backend domain. The vector is scope-changed, so a guest-side actor could affect the domain that serves networking to every guest on the host, which matters on a shared Xen host carrying several tenants. The record does not describe a working exploit, and it gives no detail beyond the fix and the Xen advisory number.

Who can reach it

A low-privileged actor on a Xen host with a paravirtual network interface served by xen-netback, most likely a guest driving its netfront connect and disconnect sequence. The attack complexity is high because a race must be won. Only Xen deployments that run netback are affected. KVM, ESXi and bare-metal GPU nodes do not use this code.

What to do

Install a kernel carrying the stable fix in the dom0 or driver domain, then reboot that domain. That restarts or interrupts every guest on the host, so plan to live-migrate guests off first or schedule a full host window. The record does not name fixed kernel versions. Check your distribution's kernel advisory and XSA-527 from the Xen project.

References

Related entries

• OpenSSH ssh client: shell metacharacters in a command-line username allow injectionCVE-2026-106583 · OpenSSH ssh client (command-line username handling)High
• Azure Kubernetes Service kernel-mshv: improper privilege management allows local privilege escalationCVE-2026-122986 · Microsoft Azure Kubernetes Service (Azure Linux kernel-mshv 6.6.137.mshv2-2.azl3)High
• libvirt: integer overflow in NodeGetFreePages gives a local user heap corruption in the root daemonCVE-2026-18917 · libvirt (NodeGetFreePages RPC handler)High
• Linux KVM - irqfd routing type clobbered on deassign: Deassigning a KVM_IRQFD clobbers the irqfd's copy of theCVE-2026-23198 · Linux KVM - irqfd routing type clobbered on deassignHigh
• Linux kernel (net/xfrm): Closing an ESP-in-TCP socket cancels its transmit work item, but the write-space callback canCVE-2026-23239 · Linux kernel (net/xfrm)High
• Linux kernel perf: use-after-free on the perf ring buffer when mmap setup fails during a concurrent attachCVE-2026-23248 · Linux kernel perf/core (perf_mmap ring-buffer refcount)High