CVE-2026-99287: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99287 is a double-unmap vulnerability in the Linux kernel's xen-netback driver, tracked as Xen Security Advisory XSA-532. When xenvif_map_frontend_data_rings() fails on an already-mapped ring, it unmaps the rings but leaves the ring pointers unchanged; the subsequent cleanup path calls xenvif_unmap_frontend_data_rings() a second time, potentially unmapping another guest's memory page. The vulnerability affects Linux kernel versions 5.5 and newer, with fixes available in versions 6.12.117, 6.18.63, and 7.3.4. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat Advisory, Openwall OSS-Sec).

The root cause is classified as CWE-1341 (Multiple Releases of Same Resource or Handle), a double-free/double-unmap condition in the xen-netback driver's ring initialization logic. When ring index values are found to be illegal during connection setup, xenvif_map_frontend_data_rings() calls xenvif_unmap_frontend_data_rings() to clean up, but does not zero out the ring pointers afterward. The cleanup path in xenvif_connect_data() then calls xenvif_disconnect_queue() → xenvif_unmap_frontend_data_rings() again, attempting to unmap the same (now stale) pointers a second time, which can result in unmapping a memory page belonging to a different guest. The fix zeroes out the sring pointers immediately after unmapping to prevent the second unmap from operating on dangling pointers (Openwall OSS-Sec, Red Hat Bugzilla).

The most likely outcome of successful exploitation is a crash of the xen-netback driver, which can escalate to a full host crash, constituting a Denial of Service (DoS) affecting all guests on the host. The XSA-532 advisory notes that information leaks or privilege escalations cannot be entirely ruled out, as the double-unmap could theoretically expose or corrupt another guest's memory page. The vulnerability requires only low-privilege local access (e.g., an unprivileged Xen guest domain) to trigger, and its scope is changed — meaning impact can extend beyond the originating guest to the hypervisor host (Openwall OSS-Sec, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The EPSS score is 0.0, reflecting very low current exploitation probability (Feedly/EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges in a Xen guest environment and the ability to trigger a failed ring initialization, which limits the practical attack surface.

Apply the Linux kernel patch that zeroes out sring pointers after unmapping (XSA-532 patch). Fixed kernel versions are 6.12.117, 6.18.63, and 7.3.4 — upgrade to one of these releases (Openwall OSS-Sec, Red Hat Bugzilla). As interim workarounds, the Xen advisory recommends using a userspace PV network backend (e.g., the QEMU-based qnic backend) or a dedicated network driver domain per guest, either of which avoids the vulnerable kernel code path (Openwall OSS-Sec).

The vulnerability was discovered by Tu Dinh of Vates and disclosed by the Xen.org security team via XSA-532 with no embargo, as it affects the same driver as the concurrently published XSA-531 (Openwall OSS-Sec). Red Hat triaged the issue at medium severity and opened a public Bugzilla entry, with 17 CC'd team members indicating active internal tracking (Red Hat Bugzilla). No notable broader media coverage or social media discussion has been observed beyond standard vulnerability tracking feeds.