Xen netfront: backend-supplied short RX slot triggers BUG() in eth_type_trans or an over-read

Impact

xen-netfront pulls the first RX slot's length into the skb head before calling eth_type_trans(), and that length comes from the backend without being checked against ETH_HLEN. A backend that hands over a first slot shorter than an Ethernet header leaves the head shorter than skb->len and __skb_pull() hits a BUG(), panicking the guest; a whole packet shorter than ETH_HLEN makes eth_type_trans() read past the end of the data. This is XSA-522. For an operator running GPU workloads inside Xen guests, the result is a crashed VM - a guest-visible denial of service driven from outside the guest's control, and on a GPU VM a crash means re-attaching devices and losing the in-flight training or serving state.

Who can reach it

Requires a malicious or compromised network backend (driver domain / dom0 netback) facing the guest; it is not triggerable by an ordinary peer on the wire. The affected code is the paravirtual frontend, so only Xen guests using xen-netfront are exposed.

What to do

Update guest kernels to a stable release carrying the fix (commits linked in the record; see XSA-522 for the Xen advisory text) and reboot each affected guest. Hosts do not need patching for this one - the fix is in the frontend driver inside the VM. Where guest reboots are expensive, note that exploitation needs control of the backend, so the priority follows how much you trust the driver domain.

References

Related entries

• Linux kernel bpf: percpu array inner map can be swapped for a smaller one, giving out-of-bounds accessCVE-2026-98376 · Linux kernel BPF percpu array map (inner map replacement in map-of-maps)Unscored
• Linux BPF: link iterator takes a reference to an unsettled link, leading to use-after-freeCVE-2026-98378 · Linux kernel BPF link iterator (bpf_link_get_curr_or_next, unsettled links)Unscored
• Linux BPF: dev-bound-only program can attach to a sibling netdev and run driver-specific kfuncsCVE-2026-98382 · Linux kernel BPF offload matching (__bpf_offload_dev_match, dev-bound programs)Unscored
• Linux BPF: LWT_SEG6LOCAL program can leave a dangling SRH pointer via bpf_skb_pull_data()CVE-2026-98383 · Linux kernel BPF LWT_SEG6LOCAL (bpf_skb_pull_data with cached SRH)Unscored
• Linux BPF: bpf_sock_destroy() reads sk_protocol out of bounds on timewait and request socketsCVE-2026-98384 · Linux kernel bpf_sock_destroy() (sk_protocol read on timewait/request socks)Unscored
• Linux kernel sched/cache: use-after-free on mm_struct when a task switches address space during account_mm_sched()CVE-2026-98385 · Linux kernel scheduler (sched/cache, sched_cache_stat in mm_struct)Unscored