CVE-2026-99287— xen-netback: Zero out sring pointers on unmap

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： xen-netback：在取消映射时将共享环（sring）指针清零当环已被映射时，如果调用失败，系统会通过将其取消映射，但该函数不会将环指针清零。随后，的清理路径会调用，而后者又会再次调用，导致系统尝试对同一组指针进行第二次取消映射。为避免此问题，在取消映射后需将环指针清零。此漏洞编号为 XSA-532。

AI Predicted 7.8 Difficulty: Hard EPSS 0.17% · P7 Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1203 · Exploitation for Client Execution T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 8

Vendor	Product	Version Range	Status
Linux	Linux	`2ac061ce97f413bfbbdd768f7d2e0fda2e8170df< 87fd475dc4e354088f6534285388e7b061f54b35`	affected
		`2ac061ce97f413bfbbdd768f7d2e0fda2e8170df< c5f54af611ff6fe1d53fa05d8e87b469dc56122b`	affected
		`2ac061ce97f413bfbbdd768f7d2e0fda2e8170df< e7ba61734d6ad6adfd5bf617052e590743211669`	affected
		`5.5`	affected
		`< 5.5`	unaffected
		`6.12.117≤ 6.12.*`	unaffected
		`6.18.63≤ 6.18.*`	unaffected
		`7.3.4≤ 7.3.*`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

xen-netback: Zero out sring pointers on unmap

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvif_map_frontend_data_rings() fails when a ring is already mapped, it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the ring pointers unchanged. xenvif_connect_data()'s cleanup path calls xenvif_disconnect_queue() which in turn calls xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the pointers a second time. Zero out the ring pointers after they are unmapped to avoid this issue. This is XSA-532

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	2ac061ce97f413bfbbdd768f7d2e0fda2e8170df ~ 87fd475dc4e354088f6534285388e7b061f54b35	-
Linux	Linux	5.5	-

II. Public POCs for CVE-2026-99287

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99287

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99287 (3)

https://www.cve.org/CVERecord?id=CVE-2026-99287

Same Patch Batch · Linux · 2026-11-10 · 4 CVEs total

CVE-2026-99285		netfilter: nft_byteorder: remove multi-register support
CVE-2026-99286		xen-netback: Fix XenBus connection failure cleanup
CVE-2026-99288		inet: reject unhashed sockets during established lookups

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux