UNKNOWN NVD
CVE-2026-100081
In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately
In the Linux kernel, the following vulnerability has been resolved:
xen-netback: defer xenvif_mcast_addr_list_free()
In order for the function to legitimately avoid locking/RCU, it needs to
run after all TX/RX processing has finished/stopped: Lookups happen from
xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
(called out of xenvif_poll()).
Move the call out of xenvif_disconnect_data() (the call to the function
from connect()'s error path doesn't require any cleaning up there), and
put it past the synchronization point in backend_disconnect().
This is XSA-527 / CVE-2026-100081.
References
- https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c
- https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1
- https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99
- https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515
- https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db
- https://www.openwall.com/lists/oss-security/2026/11/06/10
This unknown severity vulnerability was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.