CVE-2026-99286: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99286 is a race condition vulnerability in the Linux kernel's xen-netback driver, classified as XSA-531, that allows a guest to trigger a use-after-free condition during network statistics reads. The flaw exists in Linux kernel versions 4.11 and newer, with fixed versions being 6.12.117, 6.18.63, and 7.3.4. It was published on November 10, 2026, and carries a CVSS v3.1 base score of 5.6 (Medium) (Red Hat Advisory, Feedly).

The vulnerability is classified as CWE-366 (Race Condition within a Thread) and stems from missing RCU (Read-Copy-Update) synchronization in the xen-netback driver during XenBus connection failure cleanup. Specifically, vif->num_queues is not unpublished (set to zero) before synchronize_net is called, meaning concurrent readers executing xenvif_get_stats or xenvif_get_ethtool_stats under rcu_read_lock can observe a non-zero queue count and attempt to access already-freed or repurposed memory. This is a regression related to XSA-526; the prior fix failed to clear the access indicator before waiting for RCU to complete. The issue was discovered by Tu Dinh of Vates and is exploitable by a malicious guest supplying illegal Xenstore data to trigger the error path (oss-security, Red Hat Bugzilla).

Successful exploitation most likely results in a driver crash, which can escalate to a full host crash, constituting a Denial of Service (DoS) affecting the entire Xen host and all guests running on it. Information leaks from freed or repurposed memory cannot be ruled out, posing a potential confidentiality risk. The availability impact is rated High, with no direct integrity or confidentiality impact in the CVSS scoring, though the XSA advisory notes information disclosure as a secondary possibility (oss-security, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires local access with low privileges and high attack complexity, as the attacker must be a guest able to supply malicious Xenstore data to trigger the connection failure code path. The EPSS score is 0.0, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. A Nessus detection plugin (ID 378556) is available (Tenable).

1. Gain guest access: Obtain low-privileged access to a Xen guest running on a vulnerable Linux host (kernel < 6.12.117, < 6.18.63, or < 7.3.4) using the in-kernel xen-netback driver.
2. Craft malicious Xenstore data: Write illegal or malformed data into the Xenstore entries associated with the guest's network frontend, causing the xen-netback backend to encounter an error during the XenBus connection setup phase.
3. Trigger connection failure cleanup: The malformed Xenstore data causes the backend to enter the error cleanup path, where vif->num_queues is not zeroed before synchronize_net is called.
4. Race with statistics readers: Simultaneously (or via a concurrent sysfs read), trigger xenvif_get_stats or xenvif_get_ethtool_stats on the host, which captures vif->num_queues under rcu_read_lock and reads a non-zero value.
5. Trigger use-after-free: The statistics reader accesses queue structures that have already been freed, resulting in a kernel crash (DoS) or potential memory disclosure (oss-security, Red Hat Bugzilla).

• Logs: Kernel oops or BUG messages in /var/log/kern.log or dmesg referencing xen-netback, xenvif_get_stats, or xenvif_get_ethtool_stats during network interface teardown.
• Logs: Kernel panic or crash dump files (e.g., /var/crash/) generated around the time of Xen guest network connection failures.
• Logs: Xenstore audit logs showing unexpected or malformed writes to network frontend Xenstore paths (e.g., /local/domain/<id>/device/vif/).
• Process/System: Unexpected host-level kernel crashes or reboots coinciding with guest network interface connect/disconnect events.
• Network: Repeated guest network connection failures visible in Xen toolstack logs (/var/log/xen/) without a clear administrative cause.

Update the Linux kernel to version 6.12.117 or later, 6.18.63 or later, or 7.3.4 or later, depending on the active kernel branch. The fix ensures vif->num_queues is unpublished (set to zero) before synchronize_net is called during XenBus connection failure cleanup, mirroring the algorithm used in backend_disconnect. As a workaround, using a userspace PV network backend (e.g., the QEMU-based qnic backend) or a dedicated network driver domain per guest will mitigate the issue without requiring a kernel update (oss-security, Red Hat Bugzilla).

The Xen Project security team published XSA-531 alongside the CVE disclosure, noting the issue was discovered by Tu Dinh of Vates and is directly related to the prior XSA-526 fix, which was incomplete. The advisory was released without embargo due to the straightforward relationship to the recent XSA-526 patch. XCP-ng published a security update blog post covering this and related advisories for XCP-ng 8.3 LTS (oss-security, XCP-ng Blog).