Skip to main content
No exploitation reportedFix availableAwaiting NVD analysis

CVE-2026-100081

xen-netback: defer xenvif_mcast_addr_list_free()

No exploitation reported by the sources we read.

  • Published2026-11-06
  • Fixed in7.3.3 · 6.18.62 · 6.12.116 · 6.6.162 · 6.1.192 · 5.15.225

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()). Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect(). This is XSA-527 / CVE-2026-100081.

Timeline

dates in UTC
  1. 2026-11-0618:23CVE publishedCNA

Versions per branch

OSV
Linux kernel
BranchAffectedFixed in
7.3≥ 6.19.0, < 7.3.37.3.3
6.x≥ 6.13.0, < 6.18.626.18.62
6.x≥ 6.7.0, < 6.12.1166.12.116
6.x≥ 6.2.0, < 6.6.1626.6.162
6.1≥ 5.16.0, < 6.1.1926.1.192
5.x≥ 5.11.0, < 5.15.2255.15.225
5.10≥ 4.11.0, < 5.10.2745.10.274

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Products declared by the CNA2 products

As Linux, the CNA that assigned this CVE, declared them in the CVE record; versions as written.

  • Linuxother versions: not affected

    https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

    Affected
    • ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < 96e05a8ce243e2207704e2e7a6e7d1172730f515fixed in 96e05a8ce243e2207704e2e7a6e7d1172730f515git
    • ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < 0e786123e46d08d2247ce93a5435e45ed9f4c5d1fixed in 0e786123e46d08d2247ce93a5435e45ed9f4c5d1git
    • ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < 990d123d9eaa3ac6c979eed245658676d65ce0dbfixed in 990d123d9eaa3ac6c979eed245658676d65ce0dbgit
    • ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < 0d515c409033c8e2a645a781be3ca76ab825fc8cfixed in 0d515c409033c8e2a645a781be3ca76ab825fc8cgit
    • ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < a6bb2f1fa62c56279bdcdadce28d1310c5e12b62fixed in a6bb2f1fa62c56279bdcdadce28d1310c5e12b62git
    • ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < 34f0f63dc6dc11895a17bb5672451b6b11622c99fixed in 34f0f63dc6dc11895a17bb5672451b6b11622c99git
    • ≥ b17075d5c1988b83f840d272c795ac17d57ce804, < fb38fc58acb26d74fe8f7b19621fafaae3c040fffixed in fb38fc58acb26d74fe8f7b19621fafaae3c040ffgit
  • Linuxother versions: affected

    https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

    Affected
    • = 4.11no fix stated

    Not affected < 4.11 · ≥ 5.10.274, ≤ 5.10.* · ≥ 5.15.225, ≤ 5.15.* · ≥ 6.1.192, ≤ 6.1.* · ≥ 6.6.162, ≤ 6.6.* · ≥ 6.12.116, ≤ 6.12.* · ≥ 6.18.62, ≤ 6.18.*

    1 more version line in the CVE record.

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2026-11-06

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • kernelAzure Linux:3all versions · no fixed version listed
  • linuxUbuntu:Pro:20.04:LTSall versions · no fixed version listedand 21 other packages
  • linuxUbuntu:Pro:18.04:LTSall versions · no fixed version listedand 12 other packages
  • linuxUbuntu:Pro:16.04:LTSall versions · no fixed version listedand 7 other packages
  • linuxUbuntu:Pro:14.04:LTSall versions · no fixed version listedand 3 other packages
  • linuxUbuntu:26.10all versions · no fixed version listedand 8 other packages
  • linuxUbuntu:26.04:LTSall versions · no fixed version listedand 13 other packages
  • linuxUbuntu:24.04:LTSall versions · no fixed version listedand 52 other packages

23 more package ranges on OSV.dev

Full record on NVD

Fix

  1. Update Linux kernel to 7.3.3 · 6.18.62 · 6.12.116 · 6.6.162 · 6.1.192 · 5.15.225 · 5.10.274

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof of concept
Metasploit modules
none listed
Metasploit Framework

Sources

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Published
2026-11-06
Last Modified
2026-11-06
NVD status
Received
GitHub Advisory
GHSA-4grj-j5m2-48xc

Frequently asked questions

What is CVE-2026-100081?

In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()). Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect(). This is XSA-527 / CVE-2026-100081.

Is CVE-2026-100081 actively exploited?

Active exploitation of CVE-2026-100081 has not been confirmed. Its EPSS score was 0.2% on 2026-11-09, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-100081?

CVE-2026-100081 has a CVSS v3 base score of 7.8 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.

Running Linux kernel? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record