Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-100082— xen-blkback: Avoid UAF when reading I/O statistics

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： xen-blkback：在读取 I/O 统计信息时避免释放后使用（UAF）漏洞若在拆除前端设备的同时通过 sysfs 读取 I/O 统计信息，由于统计数据的读取操作与数据释放操作未进行同步，可能导致释放后使用（UAF）或空指针解引用漏洞。解决方案是使用读写锁（rwlock）来实现同步。此漏洞对应编号为 XSA-528 / CVE-2026-100082。

AI Predicted 7.8 Difficulty: Moderate Updated Nov 07, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 21

Vendor	Product	Version Range	Status
Linux	Linux	`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 253cff0526781e28b1b0f9fdacd74ecdc23d3ab7`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 2c9ccbe0ffcff3615c7ad917c49b67571a41f21c`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 58ba056991dbcec8a75e6861cb4479ac947b69e6`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< fe9ead8c5bdb752e329cecfecbdb5dfca5e9996b`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< b764e17313534794aeb99c901869f213e36a16ef`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< c49934da934cf495faf782aa5d84f413221c9be6`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< b0378161c28e77e4d0e2eda3c9433ab4394d2a2f`	affected
		`< 5.10.274`	affected
… +13 more rows

Updated Nov 07, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

xen-blkback: Avoid UAF when reading I/O statistics

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: xen-blkback: Avoid UAF when reading I/O statistics Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading of the statistics data is not synchronized with freeing the data. Use a rwlock for synchronizing. This is XSA-528 / CVE-2026-100082

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ 253cff0526781e28b1b0f9fdacd74ecdc23d3ab7	-
Linux	Linux	5.10.274 ~ 5.10.*	-

II. Public POCs for CVE-2026-100082

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-100082

请登录查看更多情报信息。

Other References for CVE-2026-100082 (7)

https://www.cve.org/CVERecord?id=CVE-2026-100082

Same Patch Batch · Linux · 2026-11-06 · 3 CVEs total

CVE-2026-100081		xen-netback: defer xenvif_mcast_addr_list_free()
CVE-2026-100080		xen-netback: Fix UAF when reading statistics data

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux