CVE-2026-99287 | BDVDB-2026-403631 Detail
LinuxLinux
Description#
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvif_map_frontend_data_rings() fails when a ring is already mapped, it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the ring pointers unchanged. xenvif_connect_data()'s cleanup path calls xenvif_disconnect_queue() which in turn calls xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the pointers a second time. Zero out the ring pointers after they are unmapped to avoid this issue. This is XSA-532
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- https://git.kernel.org/stable/c/87fd475dc4e354088f6534285388e7b061f54b35
- https://git.kernel.org/stable/c/c5f54af611ff6fe1d53fa05d8e87b469dc56122b
- https://git.kernel.org/stable/c/e7ba61734d6ad6adfd5bf617052e590743211669
- http://www.openwall.com/lists/oss-security/2026/11/10/26
- http://xenbits.xen.org/xsa/advisory-532.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.