CVE-2026-100081: Linux kernel unsafe cleanup in xen-netback

Summary

The Linux kernel's Xen network backend (xen-netback) has a flaw in how it frees its multicast address list during disconnect, which the fix addresses by deferring that cleanup until after traffic processing has stopped. The available information does not describe what an attacker can gain or how they would reach the bug.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: defer xenvif_mcast_addr_list_free()

In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()).

Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect().

This is XSA-527 / CVE-2026-100081.

cve.now Index

25Pcve.now Index 25 of 100 · methodology v3 · provisional

Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
Exposure?/25Unknown. No advisory context yet
Reach20/20Affects Linux kernel (software on nearly every server, desktop or phone)
Severity?/10Unknown. No CVSS score or vendor rating
No patch5/5No patch listed yet

What would change the score

Would score about 80 if added to CISA KEV
Would score about 75 if CISA's SSVC rates exploitation active
Would score about 47 if advisories confirm default setups are exposed

How the score works · Leaderboard

Timeline

Nov 6, 2026, 6:23 PM UTCCVE published
Nov 6, 2026, 6:33 PM UTCFirst seen by cve.now
Nov 6, 2026, 7:08 PM UTCRecord last updated

Affected versions

Linux Linux
Version range not reported
Linux Linux
4.11

Evidence 9

Show all 9 sourcesShow fewer sources

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-100081

Is CVE-2026-100081 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Which versions are affected by CVE-2026-100081?

Linux: version 4.11.Source: cve.now feed data