{"id":"CVE-2026-100081","published":"2026-11-06T19:17:03.373","lastModified":"2026-11-10T17:17:17.700","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()'s error path doesn't require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c","tags":[]},{"url":"https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1","tags":[]},{"url":"https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99","tags":[]},{"url":"https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515","tags":[]},{"url":"https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db","tags":[]},{"url":"https://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62","tags":[]},{"url":"https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/06/10","tags":[]},{"url":"http://xenbits.xen.org/xsa/advisory-527.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}