CVE-2026-99286— xen-netback: Fix XenBus connection failure cleanup

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： xen-netback：修复 XenBus 连接失败后的清理问题和函数在持有锁时读取了字段。我们需要在调用之前取消发布（unpublish），以确保后续出现的读者不会读取到非零的值，从而避免尝试访问无效的队列。该清理算法与函数中使用的逻辑相同，该逻辑由提交 b17075d5c198（"xen-netback: fix race condition on XenBus disconnect"）引入。此漏洞编号为 XSA-531。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.17% · P7 Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1069.006 T1070.004 · File Deletion

Affected Version Matrix 9

Vendor	Product	Version Range	Status
Linux	Linux	`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< ade3082dcdee17c5767069883936d64ff83f6c9f`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a97aa838903d15f865d80809f5198ff459c6634a`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 07aca7d25ce8578fedde49855983a01c537a782b`	affected
		`< 6.12.117`	affected
		`< 6.18.63`	affected
		`< 7.3.4`	affected
		`6.12.117≤ 6.12.*`	unaffected
		`6.18.63≤ 6.18.*`	unaffected
… +1 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

xen-netback: Fix XenBus connection failure cleanup

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues under rcu_read_lock. We need to unpublish vif->num_queues before synchronize_net to ensure that readers that come afterwards will not read a non-zero vif->num_queues and attempt to access invalid queues. This is the same cleanup algorithm as used in backend_disconnect and added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect"). This is XSA-531

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ ade3082dcdee17c5767069883936d64ff83f6c9f	-
Linux	Linux	6.12.117 ~ 6.12.*	-

II. Public POCs for CVE-2026-99286

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99286

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99286 (3)

https://www.cve.org/CVERecord?id=CVE-2026-99286

Same Patch Batch · Linux · 2026-11-10 · 4 CVEs total

CVE-2026-99285		netfilter: nft_byteorder: remove multi-register support
CVE-2026-99287		xen-netback: Zero out sring pointers on unmap
CVE-2026-99288		inet: reject unhashed sockets during established lookups

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux