CVE-2026-99286 is a vulnerability in Linux Kernel
Published on November 10, 2026
xen-netback: Fix XenBus connection failure cleanup
In the Linux kernel, the following vulnerability has been resolved:
xen-netback: Fix XenBus connection failure cleanup
xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues
under rcu_read_lock. We need to unpublish vif->num_queues before
synchronize_net to ensure that readers that come afterwards will not
read a non-zero vif->num_queues and attempt to access invalid queues.
This is the same cleanup algorithm as used in backend_disconnect and
added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus
disconnect").
This is XSA-531
Products Associated with CVE-2026-99286
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below ade3082dcdee17c5767069883936d64ff83f6c9f is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below a97aa838903d15f865d80809f5198ff459c6634a is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 07aca7d25ce8578fedde49855983a01c537a782b is affected.
- Before 6.12.117 is affected.
- Before 6.18.63 is affected.
- Before 7.3.4 is affected.
- Version 6.12.117, <= 6.12.* is unaffected.
- Version 6.18.63, <= 6.18.* is unaffected.
- Version 7.3.4, <= 7.3.* is unaffected.