From xen-announce-bounces@lists.xenproject.org Tue Nov 03 12:00:57 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 03 Nov 2026 12:00:57 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1469583.1678348 (Exim 4.92) (envelope-from ) id 1xODBl-0003yS-NP; Tue, 03 Nov 2026 12:00:29 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1469583.1678348; Tue, 03 Nov 2026 12:00:29 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xODBl-0003yK-KU; Tue, 03 Nov 2026 12:00:29 +0000 Received: by outflank-mailman (input) for mailman id 1469583; Tue, 03 Nov 2026 12:00:28 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xODBj-0003xy-Tf; Tue, 03 Nov 2026 12:00:28 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xODBj-00AceL-5y; Tue, 03 Nov 2026 13:00:27 +0100 Received: from [10.42.69.11] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae9ccd7-2eae-0a2a0a5409dd-0a2a450b94fc-16 for ; Tue, 03 Nov 2026 13:00:26 +0100 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-42698a.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae9ccd8-b7e8-0a2a450b0019-6882d725bbde-3 for ; Tue, 03 Nov 2026 13:00:25 +0100 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xODBc-0000000CZyb-3N5m; Tue, 03 Nov 2026 12:00:20 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xODBc-00000006KvR-33Pr; Tue, 03 Nov 2026 12:00:20 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 523 v2 (CVE-2026-102703,CVE-2026-102704) - arbitrary read/write via grant copy Message-Id: Date: Tue, 03 Nov 2026 12:00:20 +0000 X-purgate-ID: tlsNG-42698a/1793707226-A86CA9EA-19267201/0/0 X-purgate-type: clean X-purgate-size: 14589 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-102703,CVE-2026-102704 / XSA-523 version 2 arbitrary read/write via grant copy UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data were not correct in some cases: - Frame numbers and grant references could wrongly be mixed up. This is CVE-2026-102703. - Copying by frame number (rather than grant reference) is permitted only when operating on the caller's own memory. The check to enforce this restriction was misplaced. This is CVE-2026-102704. IMPACT ====== A malicious guest can read and write arbitrary memory, belonging to other domains, including Dom0. VULNERABLE SYSTEMS ================== All Xen versions from 4.6 onwards are vulnerable. Xen versions 4.5 and earlier are not vulnerable. MITIGATION ========== There is no known mitigation. CREDITS ======= This issue was discovered by Anthropic using Claude, then validated by Stephan Lipp of Ada Logics. It was then independently reported by the CodeAnt AI Security Research Team. RESOLUTION ========== Applying the appropriate set of attached patches resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa523-?.patch xen-unstable - Xen 4.19.x xsa523-4.18-?.patch Xen 4.18.x - Xen 4.17.x $ sha256sum xsa523* 87562e68c584dcc6b568348e7ba6cfde592798cb89f372364792afda65aa6895 xsa523-1.patch 9cd4e76fa3587f491f5bb0f895f375fcf24df8bd9bdf602c343081e7411b92f0 xsa523-2.patch c1accb1fa55176cb6191e091d93198068630acbc6529966738669a43d5c2e38e xsa523-4.18-1.patch efc16fe8830066276fb50f01f24a358194a752507077fdb61a60f891dc1a7019 xsa523-4.18-2.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrpzHcMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZYTAIALOhpiCcbIvbmpr8/yLSFfLXJ30HIq+rihtrrwHi IYuUujGKDMMfZ+peGDzjUvWdSpeccHVqzxYyQbeqKN+bxeiRHyPaquaKGgMJgPgg aI8/Ee5zeCBESEsAAI6Z6REXPT/ViL1MY4+gI8cGjD3CIfoBoBhHqDBxtDlkNtH6 bFH4E6CsLGPe1PELDBjEaqwFPiY03DItRBywXi9ygfATn47EnViQOlGSZm4cMIaX wdT5dJKydXjvscrglijQSKUzhqC8qaTPwxF7pNPZWjw06QNBQUvLQi68iWgA1Hp/ ACiQV+gJuY+qEH93+UbQkxl7k0DBXfZLo6CxdrKupI3MVB4= =SYnT -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa523-1.patch" Content-Disposition: attachment; filename="xsa523-1.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0OiBnbnR0YWI6IGNv bXBsZXRlIGNoZWNraW5nIGluIGdudHRhYl9jb3B5X2J1Zl92YWxpZCgpCgpUaGUgLT5oYXZlX2dy YW50IGZpZWxkIG5lZWRzIGNoZWNraW5nIG5vdCBvbmx5IGFoZWFkIG9mIGNvbXBhcmluZyBHUkVG cywKYnV0IGFsc28gYWhlYWQgb2YgY29tcGFyaW5nIE1GTnMuIEVsc2UgYSAobGlrZWx5IGludmFs aWQpIEdSRUYgZnJvbSBhbgplYXJsaWVyIGJhdGNoIGVsZW1lbnQgY2FuIGJlIG1pc3Rha2VuIGZv ciBhIChwb3NzaWJseSB2YWxpZCkgTUZOLgoKVGhpcyBpcyBDVkUtMjAyNi0xMDI3MDMsIHBhcnQg b2YgWFNBLTUyMy4KCkZpeGVzOiBkMjhmNDJmMjcwM2UgKCJncmFudC10YWJsZTogZGVmZXIgcmVs ZWFzaW5nIHBhZ2VzIGFjcXVpcmVkIGluIGEgZ3JhbnQgY29weSIpCkFzc2lzdGVkLWJ5OiBDbGF1 ZGUKUmVwb3J0ZWQtYnk6IFN0ZXBoYW4gTGlwcCA8U3RlcGhhbkBBZGFsb2dpY3MuY29tPgpSZXBv cnRlZC1ieTogQ29kZUFudCBBSSBTZWN1cml0eSBSZXNlYXJjaCA8c2VjdXJpdHlyZXNlYXJjaEBj b2RlYW50LmFpPgpTaWduZWQtb2ZmLWJ5OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+ ClJldmlld2VkLWJ5OiBBbmRyZXcgQ29vcGVyIDxhbmRyZXcuY29vcGVyM0BjaXRyaXguY29tPgoK ZGlmZiAtLWdpdCBhL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYyBiL3hlbi9jb21tb24vZ3JhbnRf dGFibGUuYwppbmRleCBiMTU4MDVmM2Y5NGQuLjNkYzVmZjg4ZGE4NSAxMDA2NDQKLS0tIGEveGVu L2NvbW1vbi9ncmFudF90YWJsZS5jCisrKyBiL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYwpAQCAt MzA4MywxMCArMzA4MywxMCBAQCBzdGF0aWMgYm9vbCBnbnR0YWJfY29weV9idWZfdmFsaWQoCiAg ICAgY29uc3Qgc3RydWN0IGdudHRhYl9jb3B5X3B0ciAqcCwgY29uc3Qgc3RydWN0IGdudHRhYl9j b3B5X2J1ZiAqYiwKICAgICBib29sIGhhc19ncmVmKQogewotICAgIGlmICggIWItPnZpcnQgKQor ICAgIGlmICggIWItPnZpcnQgfHwgYi0+aGF2ZV9ncmFudCAhPSBoYXNfZ3JlZiApCiAgICAgICAg IHJldHVybiAwOwogICAgIGlmICggaGFzX2dyZWYgKQotICAgICAgICByZXR1cm4gYi0+aGF2ZV9n cmFudCAmJiBwLT51LnJlZiA9PSBiLT5wdHIudS5yZWY7CisgICAgICAgIHJldHVybiBwLT51LnJl ZiA9PSBiLT5wdHIudS5yZWY7CiAgICAgcmV0dXJuIHAtPnUuZ21mbiA9PSBiLT5wdHIudS5nbWZu OwogfQogCg== --=separator Content-Type: application/octet-stream; name="xsa523-2.patch" Content-Disposition: attachment; filename="xsa523-2.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0OiBnbnR0YWI6IG1v dmUgIm9ubHkgbG9jYWwgZG9tYWluIG1heSBjb3B5IGJ5IGZyYW1lIiBjaGVjawoKZ250dGFiX2Nv cHlfb25lKCkgY2FsbHMgZ250dGFiX2NvcHlfbG9ja19kb21haW57cyx9KCkgb25seSBjb25kaXRp b25hbGx5LgpUaGUgbm9uLUdSRUYgY2hlY2sgdG93YXJkcyB0aGUgcmVxdWVzdG9yIGJlaW5nIERP TUlEX1NFTEYsIGhvd2V2ZXIsIG5lZWRzCmRvaW5nIG9uIGV2ZXJ5IGJhdGNoIGVsZW1lbnQuIE1v dmUgdGhlIGNoZWNrIGludG8gZ250dGFiX2NvcHlfY2xhaW1fYnVmKCkKdG8gYWNoaWV2ZSB0aGF0 LgoKVGhpcyBpcyBDVkUtMjAyNi0xMDI3MDQsIHBhcnQgb2YgWFNBLTUyMy4KCkZpeGVzOiBkMjhm NDJmMjcwM2UgKCJncmFudC10YWJsZTogZGVmZXIgcmVsZWFzaW5nIHBhZ2VzIGFjcXVpcmVkIGlu IGEgZ3JhbnQgY29weSIpCkFzc2lzdGVkLWJ5OiBDbGF1ZGUKUmVwb3J0ZWQtYnk6IFN0ZXBoYW4g TGlwcCA8U3RlcGhhbkBBZGFsb2dpY3MuY29tPgpSZXBvcnRlZC1ieTogQ29kZUFudCBBSSBTZWN1 cml0eSBSZXNlYXJjaCA8c2VjdXJpdHlyZXNlYXJjaEBjb2RlYW50LmFpPgpTaWduZWQtb2ZmLWJ5 OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+ClJldmlld2VkLWJ5OiBBbmRyZXcgQ29v cGVyIDxhbmRyZXcuY29vcGVyM0BjaXRyaXguY29tPgoKZGlmZiAtLWdpdCBhL3hlbi9jb21tb24v Z3JhbnRfdGFibGUuYyBiL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYwppbmRleCAzZGM1ZmY4OGRh ODUuLjVlNzljMDEyYjY5NSAxMDA2NDQKLS0tIGEveGVuL2NvbW1vbi9ncmFudF90YWJsZS5jCisr KyBiL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYwpAQCAtMjkzNiwxMyArMjkzNiw4IEBAIHN0cnVj dCBnbnR0YWJfY29weV9idWYgewogICAgIGJvb2wgaGF2ZV90eXBlOwogfTsKIAotc3RhdGljIGlu dCBnbnR0YWJfY29weV9sb2NrX2RvbWFpbihkb21pZF90IGRvbWlkLCBib29sIGlzX2dyZWYsCi0g ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHN0cnVjdCBnbnR0YWJfY29weV9idWYg KmJ1ZikKK3N0YXRpYyBpbnQgZ250dGFiX2NvcHlfbG9ja19kb21haW4oZG9taWRfdCBkb21pZCwg c3RydWN0IGdudHRhYl9jb3B5X2J1ZiAqYnVmKQogewotICAgIC8qIE9ubHkgRE9NSURfU0VMRiBt YXkgcmVmZXJlbmNlIHZpYSBmcmFtZS4gKi8KLSAgICBpZiAoIGRvbWlkICE9IERPTUlEX1NFTEYg JiYgIWlzX2dyZWYgKQotICAgICAgICByZXR1cm4gR05UU1RfcGVybWlzc2lvbl9kZW5pZWQ7Ci0K ICAgICBidWYtPmRvbWFpbiA9IHJjdV9sb2NrX2RvbWFpbl9ieV9hbnlfaWQoZG9taWQpOwogCiAg ICAgaWYgKCAhYnVmLT5kb21haW4gKQpAQCAtMjk3NCwxMiArMjk2OSwxMCBAQCBzdGF0aWMgaW50 IGdudHRhYl9jb3B5X2xvY2tfZG9tYWlucyhjb25zdCBzdHJ1Y3QgZ250dGFiX2NvcHkgKm9wLAog ewogICAgIGludCByYzsKIAotICAgIHJjID0gZ250dGFiX2NvcHlfbG9ja19kb21haW4ob3AtPnNv dXJjZS5kb21pZCwKLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9wLT5mbGFncyAm IEdOVENPUFlfc291cmNlX2dyZWYsIHNyYyk7CisgICAgcmMgPSBnbnR0YWJfY29weV9sb2NrX2Rv bWFpbihvcC0+c291cmNlLmRvbWlkLCBzcmMpOwogICAgIGlmICggcmMgPCAwICkKICAgICAgICAg Z290byBlcnJvcjsKLSAgICByYyA9IGdudHRhYl9jb3B5X2xvY2tfZG9tYWluKG9wLT5kZXN0LmRv bWlkLAotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb3AtPmZsYWdzICYgR05UQ09Q WV9kZXN0X2dyZWYsIGRlc3QpOworICAgIHJjID0gZ250dGFiX2NvcHlfbG9ja19kb21haW4ob3At PmRlc3QuZG9taWQsIGRlc3QpOwogICAgIGlmICggcmMgPCAwICkKICAgICAgICAgZ290byBlcnJv cjsKIApAQCAtMzA0Miw2ICszMDM1LDkgQEAgc3RhdGljIGludCBnbnR0YWJfY29weV9jbGFpbV9i dWYoY29uc3Qgc3RydWN0IGdudHRhYl9jb3B5ICpvcCwKICAgICAgICAgYnVmLT5wdHIudS5yZWYg PSBwdHItPnUucmVmOwogICAgICAgICBidWYtPmhhdmVfZ3JhbnQgPSAxOwogICAgIH0KKyAgICAv KiBPbmx5IERPTUlEX1NFTEYgbWF5IHJlZmVyZW5jZSB2aWEgZnJhbWUuICovCisgICAgZWxzZSBp ZiAoIHB0ci0+ZG9taWQgIT0gRE9NSURfU0VMRiApCisgICAgICAgIHJldHVybiBHTlRTVF9wZXJt aXNzaW9uX2RlbmllZDsKICAgICBlbHNlCiAgICAgewogICAgICAgICByYyA9IGdldF9wYWdlZF9m cmFtZShwdHItPnUuZ21mbiwgJmJ1Zi0+bWZuLCAmYnVmLT5wYWdlLAo= --=separator Content-Type: application/octet-stream; name="xsa523-4.18-1.patch" Content-Disposition: attachment; filename="xsa523-4.18-1.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0OiBnbnR0YWI6IGNv bXBsZXRlIGNoZWNraW5nIGluIGdudHRhYl9jb3B5X2J1Zl92YWxpZCgpCgpUaGUgLT5oYXZlX2dy YW50IGZpZWxkIG5lZWRzIGNoZWNraW5nIG5vdCBvbmx5IGFoZWFkIG9mIGNvbXBhcmluZyBHUkVG cywKYnV0IGFsc28gYWhlYWQgb2YgY29tcGFyaW5nIE1GTnMuIEVsc2UgYSAobGlrZWx5IGludmFs aWQpIEdSRUYgZnJvbSBhbgplYXJsaWVyIGJhdGNoIGVsZW1lbnQgY2FuIGJlIG1pc3Rha2VuIGZv ciBhIChwb3NzaWJseSB2YWxpZCkgTUZOLgoKVGhpcyBpcyBDVkUtMjAyNi0xMDI3MDMsIHBhcnQg b2YgWFNBLTUyMy4KCkZpeGVzOiBkMjhmNDJmMjcwM2UgKCJncmFudC10YWJsZTogZGVmZXIgcmVs ZWFzaW5nIHBhZ2VzIGFjcXVpcmVkIGluIGEgZ3JhbnQgY29weSIpCkFzc2lzdGVkLWJ5OiBDbGF1 ZGUKUmVwb3J0ZWQtYnk6IFN0ZXBoYW4gTGlwcCA8U3RlcGhhbkBBZGFsb2dpY3MuY29tPgpSZXBv cnRlZC1ieTogQ29kZUFudCBBSSBTZWN1cml0eSBSZXNlYXJjaCA8c2VjdXJpdHlyZXNlYXJjaEBj b2RlYW50LmFpPgpTaWduZWQtb2ZmLWJ5OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+ ClJldmlld2VkLWJ5OiBBbmRyZXcgQ29vcGVyIDxhbmRyZXcuY29vcGVyM0BjaXRyaXguY29tPgoK ZGlmZiAtLWdpdCBhL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYyBiL3hlbi9jb21tb24vZ3JhbnRf dGFibGUuYwppbmRleCA3NDJjOTc5N2M1MzUuLjg0MmQ0MzY4NDg0OSAxMDA2NDQKLS0tIGEveGVu L2NvbW1vbi9ncmFudF90YWJsZS5jCisrKyBiL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYwpAQCAt MzA4MSwxMCArMzA4MSwxMCBAQCBzdGF0aWMgYm9vbF90IGdudHRhYl9jb3B5X2J1Zl92YWxpZChj b25zdCBzdHJ1Y3QgZ250dGFiX2NvcHlfcHRyICpwLAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgY29uc3Qgc3RydWN0IGdudHRhYl9jb3B5X2J1ZiAqYiwKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGJvb2xfdCBoYXNfZ3JlZikKIHsKLSAgICBpZiAoICFi LT52aXJ0ICkKKyAgICBpZiAoICFiLT52aXJ0IHx8IGItPmhhdmVfZ3JhbnQgIT0gaGFzX2dyZWYg KQogICAgICAgICByZXR1cm4gMDsKICAgICBpZiAoIGhhc19ncmVmICkKLSAgICAgICAgcmV0dXJu IGItPmhhdmVfZ3JhbnQgJiYgcC0+dS5yZWYgPT0gYi0+cHRyLnUucmVmOworICAgICAgICByZXR1 cm4gcC0+dS5yZWYgPT0gYi0+cHRyLnUucmVmOwogICAgIHJldHVybiBwLT51LmdtZm4gPT0gYi0+ cHRyLnUuZ21mbjsKIH0KIAo= --=separator Content-Type: application/octet-stream; name="xsa523-4.18-2.patch" Content-Disposition: attachment; filename="xsa523-4.18-2.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0OiBnbnR0YWI6IG1v dmUgIm9ubHkgbG9jYWwgZG9tYWluIG1heSBjb3B5IGJ5IGZyYW1lIiBjaGVjawoKZ250dGFiX2Nv cHlfb25lKCkgY2FsbHMgZ250dGFiX2NvcHlfbG9ja19kb21haW57cyx9KCkgb25seSBjb25kaXRp b25hbGx5LgpUaGUgbm9uLUdSRUYgY2hlY2sgdG93YXJkcyB0aGUgcmVxdWVzdG9yIGJlaW5nIERP TUlEX1NFTEYsIGhvd2V2ZXIsIG5lZWRzCmRvaW5nIG9uIGV2ZXJ5IGJhdGNoIGVsZW1lbnQuIE1v dmUgdGhlIGNoZWNrIGludG8gZ250dGFiX2NvcHlfY2xhaW1fYnVmKCkKdG8gYWNoaWV2ZSB0aGF0 LgoKVGhpcyBpcyBDVkUtMjAyNi0xMDI3MDQsIHBhcnQgb2YgWFNBLTUyMy4KCkZpeGVzOiBkMjhm NDJmMjcwM2UgKCJncmFudC10YWJsZTogZGVmZXIgcmVsZWFzaW5nIHBhZ2VzIGFjcXVpcmVkIGlu IGEgZ3JhbnQgY29weSIpCkFzc2lzdGVkLWJ5OiBDbGF1ZGUKUmVwb3J0ZWQtYnk6IFN0ZXBoYW4g TGlwcCA8U3RlcGhhbkBBZGFsb2dpY3MuY29tPgpSZXBvcnRlZC1ieTogQ29kZUFudCBBSSBTZWN1 cml0eSBSZXNlYXJjaCA8c2VjdXJpdHlyZXNlYXJjaEBjb2RlYW50LmFpPgpTaWduZWQtb2ZmLWJ5 OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+ClJldmlld2VkLWJ5OiBBbmRyZXcgQ29v cGVyIDxhbmRyZXcuY29vcGVyM0BjaXRyaXguY29tPgoKZGlmZiAtLWdpdCBhL3hlbi9jb21tb24v Z3JhbnRfdGFibGUuYyBiL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYwppbmRleCA4NDJkNDM2ODQ4 NDkuLjAzNTQzZmMzMzVhOSAxMDA2NDQKLS0tIGEveGVuL2NvbW1vbi9ncmFudF90YWJsZS5jCisr KyBiL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYwpAQCAtMjkzNCwxMyArMjkzNCw4IEBAIHN0cnVj dCBnbnR0YWJfY29weV9idWYgewogICAgIGJvb2xfdCBoYXZlX3R5cGU7CiB9OwogCi1zdGF0aWMg aW50IGdudHRhYl9jb3B5X2xvY2tfZG9tYWluKGRvbWlkX3QgZG9taWQsIGJvb2wgaXNfZ3JlZiwK LSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3RydWN0IGdudHRhYl9jb3B5X2J1 ZiAqYnVmKQorc3RhdGljIGludCBnbnR0YWJfY29weV9sb2NrX2RvbWFpbihkb21pZF90IGRvbWlk LCBzdHJ1Y3QgZ250dGFiX2NvcHlfYnVmICpidWYpCiB7Ci0gICAgLyogT25seSBET01JRF9TRUxG IG1heSByZWZlcmVuY2UgdmlhIGZyYW1lLiAqLwotICAgIGlmICggZG9taWQgIT0gRE9NSURfU0VM RiAmJiAhaXNfZ3JlZiApCi0gICAgICAgIHJldHVybiBHTlRTVF9wZXJtaXNzaW9uX2RlbmllZDsK LQogICAgIGJ1Zi0+ZG9tYWluID0gcmN1X2xvY2tfZG9tYWluX2J5X2FueV9pZChkb21pZCk7CiAK ICAgICBpZiAoICFidWYtPmRvbWFpbiApCkBAIC0yOTcyLDEyICsyOTY3LDEwIEBAIHN0YXRpYyBp bnQgZ250dGFiX2NvcHlfbG9ja19kb21haW5zKGNvbnN0IHN0cnVjdCBnbnR0YWJfY29weSAqb3As CiB7CiAgICAgaW50IHJjOwogCi0gICAgcmMgPSBnbnR0YWJfY29weV9sb2NrX2RvbWFpbihvcC0+ c291cmNlLmRvbWlkLAotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb3AtPmZsYWdz ICYgR05UQ09QWV9zb3VyY2VfZ3JlZiwgc3JjKTsKKyAgICByYyA9IGdudHRhYl9jb3B5X2xvY2tf ZG9tYWluKG9wLT5zb3VyY2UuZG9taWQsIHNyYyk7CiAgICAgaWYgKCByYyA8IDAgKQogICAgICAg ICBnb3RvIGVycm9yOwotICAgIHJjID0gZ250dGFiX2NvcHlfbG9ja19kb21haW4ob3AtPmRlc3Qu ZG9taWQsCi0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvcC0+ZmxhZ3MgJiBHTlRD T1BZX2Rlc3RfZ3JlZiwgZGVzdCk7CisgICAgcmMgPSBnbnR0YWJfY29weV9sb2NrX2RvbWFpbihv cC0+ZGVzdC5kb21pZCwgZGVzdCk7CiAgICAgaWYgKCByYyA8IDAgKQogICAgICAgICBnb3RvIGVy cm9yOwogCkBAIC0zMDQwLDYgKzMwMzMsOSBAQCBzdGF0aWMgaW50IGdudHRhYl9jb3B5X2NsYWlt X2J1Zihjb25zdCBzdHJ1Y3QgZ250dGFiX2NvcHkgKm9wLAogICAgICAgICBidWYtPnB0ci51LnJl ZiA9IHB0ci0+dS5yZWY7CiAgICAgICAgIGJ1Zi0+aGF2ZV9ncmFudCA9IDE7CiAgICAgfQorICAg IC8qIE9ubHkgRE9NSURfU0VMRiBtYXkgcmVmZXJlbmNlIHZpYSBmcmFtZS4gKi8KKyAgICBlbHNl IGlmICggcHRyLT5kb21pZCAhPSBET01JRF9TRUxGICkKKyAgICAgICAgcmV0dXJuIEdOVFNUX3Bl cm1pc3Npb25fZGVuaWVkOwogICAgIGVsc2UKICAgICB7CiAgICAgICAgIHJjID0gZ2V0X3BhZ2Vk X2ZyYW1lKHB0ci0+dS5nbWZuLCAmYnVmLT5tZm4sICZidWYtPnBhZ2UsCg== --=separator-- From xen-announce-bounces@lists.xenproject.org Fri Nov 06 15:16:27 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 06 Nov 2026 15:16:27 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1476747.1682802 (Exim 4.92) (envelope-from ) id 1xPLfm-0005PC-U2; Fri, 06 Nov 2026 15:16:10 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1476747.1682802; Fri, 06 Nov 2026 15:16:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xPLfm-0005Nq-J9; Fri, 06 Nov 2026 15:16:10 +0000 Received: by outflank-mailman (input) for mailman id 1476747; Fri, 06 Nov 2026 15:16:09 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xPLfl-0004y1-Ms; Fri, 06 Nov 2026 15:16:09 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xPLfk-000GUT-RI; Fri, 06 Nov 2026 16:16:08 +0100 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aedef2e-bab6-0a2a0a5309dd-0a2a45018d98-22 for ; Fri, 06 Nov 2026 16:16:08 +0100 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aedef37-5984-0a2a45010019-6882d725dc6a-3 for ; Fri, 06 Nov 2026 16:16:08 +0100 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xPLfh-00000001GdW-1Cvs; Fri, 06 Nov 2026 15:16:05 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xPLfh-0000000A5vb-11J3; Fri, 06 Nov 2026 15:16:05 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 528 v1 (CVE-2026-100082) - Linux xen-blkback: guest can trigger use-after-free for reading statistic data Message-Id: Date: Fri, 06 Nov 2026 15:16:05 +0000 X-purgate-ID: tlsNG-d62444/1793978168-BD146757-8A31FDDE/0/0 X-purgate-type: clean X-purgate-size: 7764 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-100082 / XSA-528 Linux xen-blkback: guest can trigger use-after-free for reading statistic data ISSUE DESCRIPTION ================= he driver does not serialise reads of the device I/O statistics against the freeing of the memory that holds them. This leads to a use-after-free when reading statistical counters while the device is being torn down. IMPACT ====== This most likely crashes the driver, and possibly the host, causing a Denial of Service (DoS) for the entire host. Information leaks cannot be ruled out. VULNERABLE SYSTEMS ================== Linux versions 4.5 and newer are vulnerable. MITIGATION ========== Using a userspace PV block backend (e.g. the qemu based "qdisk" backend) will mitigate the problem. Using a dedicated block driver domain per guest will mitigate the problem. CREDITS ======= This issue was discovered by Yehyeong Lee of Hyundai Mobis. RESOLUTION ========== Applying the attached patch resolves this issue. xsa528-linux.patch Linux $ sha256sum xsa528* 848d5cc56a7b31e84399ac00d616c36bd2b5efdcc0f23017a7590b1b58900c19 xsa528-linux.patch $ NOTE REGARDING LACK OF EMBARGO ============================== A very similar issue was disclosed in public. -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrt7tAMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZTFkH/jRhPRPUnQb/2KV42fKAPvQtffdEIWr72wc5ogYm d6rTBU81hLdZAyq+Zo2jwhgggjXNeurD84z1Lnr8X6YgnRBAHfWhOd28V583K83j BzmWsbFeUsMLjiaWuftzdr1RdpqB1ajk6NRAnR5Eb4jrWltIOekDgSviJupMfbRs iq9pM0J/zbFBcIu21Lor4R5F8wYLx3cbzE0LuSq0j+D5uCMFIAhkea+7ReadQYxr +L3LbEJIdcGpfZlcf9SRgJ8KKJr6d3JlHAVx2fpq8w/buwRFv3M87VL64MPUk7Tr kJ/Wpl+hpvnTNE0m88eF1x3pMkdco6fwzz/xg7lvxm1k2Ho= =CcMW -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa528-linux.patch" Content-Disposition: attachment; filename="xsa528-linux.patch" Content-Transfer-Encoding: base64 RnJvbTogSnVlcmdlbiBHcm9zcyA8amdyb3NzQHN1c2UuY29tPgpEYXRlOiBUaHUsIDUgTm92IDIw MjYgMDg6Mjc6MzggKzAxMDAKU3ViamVjdDogW1BBVENIXSB4ZW4tYmxrYmFjazogQXZvaWQgVUFG IHdoZW4gcmVhZGluZyBJL08gc3RhdGlzdGljcwpNSU1FLVZlcnNpb246IDEuMApDb250ZW50LVR5 cGU6IHRleHQvcGxhaW47IGNoYXJzZXQ9VVRGLTgKQ29udGVudC1UcmFuc2Zlci1FbmNvZGluZzog OGJpdAoKUmVhZGluZyBJL08gc3RhdGlzdGljcyB2aWEgc3lzZnMgY29uY3VycmVudGx5IHdpdGgg dGVhcmluZyBkb3duIGEKZnJvbnRlbmQgZGV2aWNlIG1pZ2h0IHJlc3VsdCBpbiBVQUYgb3IgYSBO VUxMIGRlcmVmZXJlbmNlLCBhcyB0aGUKcmVhZGluZyBvZiB0aGUgc3RhdGlzdGljcyBkYXRhIGlz IG5vdCBzeW5jaHJvbml6ZWQgd2l0aCBmcmVlaW5nIHRoZQpkYXRhLgoKVXNlIGEgcndsb2NrIGZv ciBzeW5jaHJvbml6aW5nLgoKVGhpcyBpcyBYU0EtNTI4IC8gQ1ZFLTIwMjYtMTAwMDgyCgpGaXhl czogZGI2ZmJjMTA2Nzg2ICgieGVuL2Jsa2JhY2s6IG1ha2Ugc3RfIHN0YXRpc3RpY3MgcGVyIHJp bmciKQpSZXBvcnRlZC1ieTogWWVoeWVvbmcgTGVlIDx5aGxlZUBpc3NsYWIua29yZWEuYWMua3I+ ClNpZ25lZC1vZmYtYnk6IEp1ZXJnZW4gR3Jvc3MgPGpncm9zc0BzdXNlLmNvbT4KQWNrZWQtYnk6 IFJvZ2VyIFBhdSBNb25uw6kgPHJvZ2VyQHhlbnByb2plY3Qub3JnPgotLS0KIGRyaXZlcnMvYmxv Y2sveGVuLWJsa2JhY2svY29tbW9uLmggfCAgMiArKwogZHJpdmVycy9ibG9jay94ZW4tYmxrYmFj ay94ZW5idXMuYyB8IDMwICsrKysrKysrKysrKysrKysrKysrKysrKy0tLS0tLQogMiBmaWxlcyBj aGFuZ2VkLCAyNiBpbnNlcnRpb25zKCspLCA2IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL2Ry aXZlcnMvYmxvY2sveGVuLWJsa2JhY2svY29tbW9uLmggYi9kcml2ZXJzL2Jsb2NrL3hlbi1ibGti YWNrL2NvbW1vbi5oCmluZGV4IGI0MjdkNTRiYzEyMC4uZjU4OTBiM2YxZGY5IDEwMDY0NAotLS0g YS9kcml2ZXJzL2Jsb2NrL3hlbi1ibGtiYWNrL2NvbW1vbi5oCisrKyBiL2RyaXZlcnMvYmxvY2sv eGVuLWJsa2JhY2svY29tbW9uLmgKQEAgLTMxOCw4ICszMTgsMTAgQEAgc3RydWN0IHhlbl9ibGtp ZiB7CiAJdW5zaWduZWQgaW50CQlucl9yaW5nX3BhZ2VzOwogCWJvb2wJCQltdWx0aV9yZWY7CiAJ LyogQWxsIHJpbmdzIGZvciB0aGlzIGRldmljZS4gKi8KKwlyd2xvY2tfdAkJcmluZ3NfbG9jazsK IAlzdHJ1Y3QgeGVuX2Jsa2lmX3JpbmcJKnJpbmdzOwogCXVuc2lnbmVkIGludAkJbnJfcmluZ3M7 CisKIAl1bnNpZ25lZCBsb25nCQlidWZmZXJfc3F1ZWV6ZV9lbmQ7CiB9OwogCmRpZmYgLS1naXQg YS9kcml2ZXJzL2Jsb2NrL3hlbi1ibGtiYWNrL3hlbmJ1cy5jIGIvZHJpdmVycy9ibG9jay94ZW4t YmxrYmFjay94ZW5idXMuYwppbmRleCA0Yjg2NWVmODAwYjEuLjhkMGZmOGZjYWMyMiAxMDA2NDQK LS0tIGEvZHJpdmVycy9ibG9jay94ZW4tYmxrYmFjay94ZW5idXMuYworKysgYi9kcml2ZXJzL2Js b2NrL3hlbi1ibGtiYWNrL3hlbmJ1cy5jCkBAIC0xMjcsMTQgKzEyNywyMyBAQCBzdGF0aWMgdm9p ZCB4ZW5fdXBkYXRlX2Jsa2lmX3N0YXR1cyhzdHJ1Y3QgeGVuX2Jsa2lmICpibGtpZikKIAlyZXR1 cm47CiB9CiAKLXN0YXRpYyBpbnQgeGVuX2Jsa2lmX2FsbG9jX3JpbmdzKHN0cnVjdCB4ZW5fYmxr aWYgKmJsa2lmKQorc3RhdGljIGludCB4ZW5fYmxraWZfYWxsb2NfcmluZ3Moc3RydWN0IHhlbl9i bGtpZiAqYmxraWYsCisJCQkJIHVuc2lnbmVkIGludCBucl9yaW5ncykKIHsKIAl1bnNpZ25lZCBp bnQgcjsKKwlzdHJ1Y3QgeGVuX2Jsa2lmX3JpbmcgKnJpbmdzOwogCi0JYmxraWYtPnJpbmdzID0g a3phbGxvY19vYmpzKHN0cnVjdCB4ZW5fYmxraWZfcmluZywgYmxraWYtPm5yX3JpbmdzKTsKLQlp ZiAoIWJsa2lmLT5yaW5ncykKKwlyaW5ncyA9IGt6YWxsb2Nfb2JqcyhzdHJ1Y3QgeGVuX2Jsa2lm X3JpbmcsIG5yX3JpbmdzKTsKKwlpZiAoIXJpbmdzKQogCQlyZXR1cm4gLUVOT01FTTsKIAorCXdy aXRlX2xvY2soJmJsa2lmLT5yaW5nc19sb2NrKTsKKworCWJsa2lmLT5yaW5ncyA9IHJpbmdzOwor CWJsa2lmLT5ucl9yaW5ncyA9IG5yX3JpbmdzOworCisJd3JpdGVfdW5sb2NrKCZibGtpZi0+cmlu Z3NfbG9jayk7CisKIAlmb3IgKHIgPSAwOyByIDwgYmxraWYtPm5yX3JpbmdzOyByKyspIHsKIAkJ c3RydWN0IHhlbl9ibGtpZl9yaW5nICpyaW5nID0gJmJsa2lmLT5yaW5nc1tyXTsKIApAQCAtMTc0 LDYgKzE4Myw3IEBAIHN0YXRpYyBzdHJ1Y3QgeGVuX2Jsa2lmICp4ZW5fYmxraWZfYWxsb2MoZG9t aWRfdCBkb21pZCkKIAlibGtpZi0+ZG9taWQgPSBkb21pZDsKIAlhdG9taWNfc2V0KCZibGtpZi0+ cmVmY250LCAxKTsKIAlpbml0X2NvbXBsZXRpb24oJmJsa2lmLT5kcmFpbl9jb21wbGV0ZSk7CisJ cndsb2NrX2luaXQoJmJsa2lmLT5yaW5nc19sb2NrKTsKIAogCS8qCiAJICogQmVjYXVzZSBmcmVl aW5nIGJhY2sgdG8gdGhlIGNhY2hlIG1heSBiZSBkZWZlcnJlZCwgaXQgaXMgbm90CkBAIC0yNjgs NiArMjc4LDcgQEAgc3RhdGljIGludCB4ZW5fYmxraWZfZGlzY29ubmVjdChzdHJ1Y3QgeGVuX2Js a2lmICpibGtpZikKIAlzdHJ1Y3QgcGVuZGluZ19yZXEgKnJlcSwgKm47CiAJdW5zaWduZWQgaW50 IGosIHI7CiAJYm9vbCBidXN5ID0gZmFsc2U7CisJc3RydWN0IHhlbl9ibGtpZl9yaW5nICpyaW5n czsKIAogCWZvciAociA9IDA7IHIgPCBibGtpZi0+bnJfcmluZ3M7IHIrKykgewogCQlzdHJ1Y3Qg eGVuX2Jsa2lmX3JpbmcgKnJpbmcgPSAmYmxraWYtPnJpbmdzW3JdOwpAQCAtMzM0LDEwICszNDUs MTYgQEAgc3RhdGljIGludCB4ZW5fYmxraWZfZGlzY29ubmVjdChzdHJ1Y3QgeGVuX2Jsa2lmICpi bGtpZikKIAkgKiBibGtpZi0+cmluZ3Mgd2FzIGFsbG9jYXRlZCBpbiBjb25uZWN0X3JpbmcsIHNv IHdlIHNob3VsZCBmcmVlIGl0IGluCiAJICogaGVyZS4KIAkgKi8KLQlrZnJlZShibGtpZi0+cmlu Z3MpOworCXdyaXRlX2xvY2soJmJsa2lmLT5yaW5nc19sb2NrKTsKKworCXJpbmdzID0gYmxraWYt PnJpbmdzOwogCWJsa2lmLT5yaW5ncyA9IE5VTEw7CiAJYmxraWYtPm5yX3JpbmdzID0gMDsKIAor CXdyaXRlX3VubG9jaygmYmxraWYtPnJpbmdzX2xvY2spOworCisJa2ZyZWUocmluZ3MpOworCiAJ cmV0dXJuIDA7CiB9CiAKQEAgLTM4NSw2ICs0MDIsNyBAQCB2b2lkIHhlbl9ibGtpZl9pbnRlcmZh Y2VfZmluaSh2b2lkKQogCQl1bnNpZ25lZCBpbnQgaTsJCQkJCQlcCiAJCXVuc2lnbmVkIGxvbmcg bG9uZyByZXN1bHQgPSAwOwkJCQlcCiAJCQkJCQkJCQlcCisJCXJlYWRfbG9jaygmYmxraWYtPnJp bmdzX2xvY2spOwkJCQlcCiAJCWlmICghYmxraWYtPnJpbmdzKQkJCQlcCiAJCQlnb3RvIG91dDsJ CQkJCVwKIAkJCQkJCQkJCVwKQEAgLTM5NSw2ICs0MTMsNyBAQCB2b2lkIHhlbl9ibGtpZl9pbnRl cmZhY2VfZmluaSh2b2lkKQogCQl9CQkJCQkJCVwKIAkJCQkJCQkJCVwKIG91dDoJCQkJCQkJCQlc CisJCXJlYWRfdW5sb2NrKCZibGtpZi0+cmluZ3NfbG9jayk7CQkJXAogCQlyZXR1cm4gc3ByaW50 ZihidWYsIGZvcm1hdCwgcmVzdWx0KTsJCQlcCiAJfQkJCQkJCQkJXAogCXN0YXRpYyBERVZJQ0Vf QVRUUihuYW1lLCAwNDQ0LCBzaG93XyMjbmFtZSwgTlVMTCkKQEAgLTExMDIsOCArMTEyMSw3IEBA IHN0YXRpYyBpbnQgY29ubmVjdF9yaW5nKHN0cnVjdCBiYWNrZW5kX2luZm8gKmJlKQogCQkJCXJl cXVlc3RlZF9udW1fcXVldWVzLCB4ZW5ibGtfbWF4X3F1ZXVlcyk7CiAJCXJldHVybiAtRU5PU1lT OwogCX0KLQlibGtpZi0+bnJfcmluZ3MgPSByZXF1ZXN0ZWRfbnVtX3F1ZXVlczsKLQlpZiAoeGVu X2Jsa2lmX2FsbG9jX3JpbmdzKGJsa2lmKSkKKwlpZiAoeGVuX2Jsa2lmX2FsbG9jX3JpbmdzKGJs a2lmLCByZXF1ZXN0ZWRfbnVtX3F1ZXVlcykpCiAJCXJldHVybiAtRU5PTUVNOwogCiAJcHJfaW5m bygiJXM6IHVzaW5nICVkIHF1ZXVlcywgcHJvdG9jb2wgJWQgKCVzKSAlc1xuIiwgZGV2LT5ub2Rl bmFtZSwKLS0gCjIuNTYuMAoK --=separator-- From xen-announce-bounces@lists.xenproject.org Fri Nov 06 15:16:27 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 06 Nov 2026 15:16:27 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1476743.1682764 (Exim 4.92) (envelope-from ) id 1xPLfj-0004Xg-J0; Fri, 06 Nov 2026 15:16:07 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1476743.1682764; Fri, 06 Nov 2026 15:16:07 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xPLfj-0004X7-ES; Fri, 06 Nov 2026 15:16:07 +0000 Received: by outflank-mailman (input) for mailman id 1476743; Fri, 06 Nov 2026 15:16:06 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xPLfi-0004Gd-Sh; Fri, 06 Nov 2026 15:16:06 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xPLfi-00447Q-9G; Fri, 06 Nov 2026 16:16:06 +0100 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aedef2d-2eae-0a2a0a5409dd-0a2a450c88d0-20 for ; Fri, 06 Nov 2026 16:16:06 +0100 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aedef34-f479-0a2a450c0019-6882d725be5a-3 for ; Fri, 06 Nov 2026 16:16:05 +0100 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xPLfe-00000001Gd5-1DVm; Fri, 06 Nov 2026 15:16:02 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xPLfe-0000000A5tc-0wMP; Fri, 06 Nov 2026 15:16:02 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 527 v1 (CVE-2026-100081) - Linux xen-netback: guest can trigger use-after-free for reading multicast data Message-Id: Date: Fri, 06 Nov 2026 15:16:02 +0000 X-purgate-ID: tlsNG-d25034/1793978166-770D9A5B-658D72A8/0/0 X-purgate-type: clean X-purgate-size: 4580 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-100081 / XSA-527 Linux xen-netback: guest can trigger use-after-free for reading multicast data ISSUE DESCRIPTION ================= Multicast handling in the driver is implemented as a lookup early on the transmit (guest receive) path. The respective function can be invoked in parallel with teardown of a device. Thus the lookup may access data which was already freed, with that memory perhaps already being in new use elsewhere. IMPACT ====== The most likely outcome is a driver crash, possibly escalated to a host crash. This then is a Denial of Service (DoS) affecting the entire host. Information leaks and, with very low likelihood, privilege escalation cannot be ruled out. VULNERABLE SYSTEMS ================== Linux versions 4.3 and newer are vulnerable. MITIGATION ========== Using a userspace PV network backend (e.g. the qemu based "qnic" backend) will mitigate the problem. Using a dedicated network driver domain per guest will mitigate the problem. CREDITS ======= This issue was discovered by kerhunt. RESOLUTION ========== Applying the attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa527-linux.patch Linux 7.4-rc - 5.5 $ sha256sum xsa527* f68ebd9c262ac005043c9832bc8f73d70f5e083d1c9435b55d4dccadbb3e40df xsa527-linux.patch $ NOTE REGARDING LACK OF EMBARGO ============================== A closely related issue was disclosed in public. -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrt7s4MHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZeNAH/j1BrfAQ6QeYh/fzh1ql5EG2e2hE3m3cP6k84uBh ZIVNAcqat+6UsxF/jaHRyTV49cts4HVHDBu9mpoi1vWkLhoSK7kkLl37oh0ar71P XpCtLfgqzCPd/0F19at2l5sigXwZA/GvRbn4aEVp4s+dC5U/a67IZJtj/xMvTGVB oOeIEenbIQHrWMCQmXaLHa2Ht2qCgJyyt0LzAFZf2pTbcl6tnCt8yQFVHh2ABa7e 5rXgH3bJRp6AOod3nsAkL+al2l8ShAx/TTIvDUxZw+qD6bELMDBwGYWSTMCRogAH JcqEMRgZWL87gx2ubKJkG57pGuoXv8ydhD2o0/9WrBPRbzs= =dUnZ -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa527-linux.patch" Content-Disposition: attachment; filename="xsa527-linux.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0OiB4ZW4tbmV0YmFj azogZGVmZXIgeGVudmlmX21jYXN0X2FkZHJfbGlzdF9mcmVlKCkKCkluIG9yZGVyIGZvciB0aGUg ZnVuY3Rpb24gdG8gbGVnaXRpbWF0ZWx5IGF2b2lkIGxvY2tpbmcvUkNVLCBpdCBuZWVkcyB0bwpy dW4gYWZ0ZXIgYWxsIFRYL1JYIHByb2Nlc3NpbmcgaGFzIGZpbmlzaGVkL3N0b3BwZWQ6IExvb2t1 cHMgaGFwcGVuIGZyb20KeGVudmlmX3N0YXJ0X3htaXQoKSwgd2hpbGUgYWRkcy9yZW1vdmVzIGhh cHBlbiBmcm9tIHhlbnZpZl90eF9hY3Rpb24oKQooY2FsbGVkIG91dCBvZiB4ZW52aWZfcG9sbCgp KS4KCk1vdmUgdGhlIGNhbGwgb3V0IG9mIHhlbnZpZl9kaXNjb25uZWN0X2RhdGEoKSAodGhlIGNh bGwgdG8gdGhlIGZ1bmN0aW9uCmZyb20gY29ubmVjdCgpJ3MgZXJyb3IgcGF0aCBkb2Vzbid0IHJl cXVpcmUgYW55IGNsZWFuaW5nIHVwIHRoZXJlKSwgYW5kCnB1dCBpdCBwYXN0IHRoZSBzeW5jaHJv bml6YXRpb24gcG9pbnQgaW4gYmFja2VuZF9kaXNjb25uZWN0KCkuCgpUaGlzIGlzIFhTQS01Mjcg LyBDVkUtMjAyNi0xMDAwODEuCgpGaXhlczogYjE3MDc1ZDVjMTk4ICgieGVuLW5ldGJhY2s6IGZp eCByYWNlIGNvbmRpdGlvbiBvbiBYZW5CdXMgZGlzY29ubmVjdCIpClJlcG9ydGVkLWJ5OiBrZXJo dW50IDxrZXJodW50QHByb3Rvbi5tZT4KU2lnbmVkLW9mZi1ieTogSmFuIEJldWxpY2ggPGpiZXVs aWNoQHN1c2UuY29tPgpSZXZpZXdlZC1ieTogSnVlcmdlbiBHcm9zcyA8amdyb3NzQHN1c2UuY29t PgoKLS0tIGEvZHJpdmVycy9uZXQveGVuLW5ldGJhY2svaW50ZXJmYWNlLmMKKysrIGIvZHJpdmVy cy9uZXQveGVuLW5ldGJhY2svaW50ZXJmYWNlLmMKQEAgLTgxMiw4ICs4MTIsNiBAQCB2b2lkIHhl bnZpZl9kaXNjb25uZWN0X2RhdGEoc3RydWN0IHhlbnZpCiAKIAkJeGVudmlmX2Rpc2Nvbm5lY3Rf cXVldWUocXVldWUpOwogCX0KLQotCXhlbnZpZl9tY2FzdF9hZGRyX2xpc3RfZnJlZSh2aWYpOwog fQogCiB2b2lkIHhlbnZpZl9kaXNjb25uZWN0X2N0cmwoc3RydWN0IHhlbnZpZiAqdmlmKQotLS0g YS9kcml2ZXJzL25ldC94ZW4tbmV0YmFjay94ZW5idXMuYworKysgYi9kcml2ZXJzL25ldC94ZW4t bmV0YmFjay94ZW5idXMuYwpAQCAtMjY3LDYgKzI2Nyw4IEBAIHN0YXRpYyB2b2lkIGJhY2tlbmRf ZGlzY29ubmVjdChzdHJ1Y3QgYmEKIAkJdmlmLT5udW1fcXVldWVzID0gMDsKIAkJc3luY2hyb25p emVfbmV0KCk7CiAKKwkJeGVudmlmX21jYXN0X2FkZHJfbGlzdF9mcmVlKHZpZik7CisKIAkJZm9y IChxdWV1ZV9pbmRleCA9IDA7IHF1ZXVlX2luZGV4IDwgbnVtX3F1ZXVlczsgKytxdWV1ZV9pbmRl eCkKIAkJCXhlbnZpZl9kZWluaXRfcXVldWUoJnZpZi0+cXVldWVzW3F1ZXVlX2luZGV4XSk7CiAK --=separator-- From xen-announce-bounces@lists.xenproject.org Fri Nov 06 15:16:27 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 06 Nov 2026 15:16:27 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1476739.1682724 (Exim 4.92) (envelope-from ) id 1xPLfg-0003gn-NH; Fri, 06 Nov 2026 15:16:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1476739.1682724; Fri, 06 Nov 2026 15:16:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xPLfg-0003gC-IA; Fri, 06 Nov 2026 15:16:04 +0000 Received: by outflank-mailman (input) for mailman id 1476739; Fri, 06 Nov 2026 15:16:03 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xPLff-0003fk-S0; Fri, 06 Nov 2026 15:16:03 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xPLff-007Zic-1B; Fri, 06 Nov 2026 16:16:03 +0100 Received: from [10.42.69.8] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aedef1d-8faa-0a2a0a5109dd-0a2a4508a628-44 for ; Fri, 06 Nov 2026 16:16:02 +0100 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-c1860d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aedef31-f659-0a2a45080019-6882d725d98c-3 for ; Fri, 06 Nov 2026 16:16:02 +0100 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xPLfb-00000001GcE-1tmf; Fri, 06 Nov 2026 15:15:59 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xPLfb-0000000A5rj-1W0D; Fri, 06 Nov 2026 15:15:59 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 526 v1 (CVE-2026-100080) - Linux xen-netback: guest can trigger use-after-free for Message-Id: Date: Fri, 06 Nov 2026 15:15:59 +0000 X-purgate-ID: tlsNG-c1860d/1793978162-D437587B-E71D9501/0/0 X-purgate-type: clean X-purgate-size: 4476 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-100080 / XSA-526 Linux xen-netback: guest can trigger use-after-free for network statistics reads ISSUE DESCRIPTION ================= The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.g. due to illegal Xenstore data filled in by the guest), the statistic data is being freed without synchronizing the RCU state. In case the data is being read via sysfs in this phase, access to already freed memory or memory being in new use is possible. IMPACT ====== The most likely outcome is a driver crash, possibly escalated to a host crash. This then is a Denial of Service (DoS) affecting the entire host. Information leaks cannot be ruled out. VULNERABLE SYSTEMS ================== Linux versions 4.11 and newer are vulnerable. MITIGATION ========== Using a userspace PV network backend (e.g. the qemu based "qnic" backend) will mitigate the problem. Using a dedicated network driver domain per guest will mitigate the problem. CREDITS ======= This issue was discovered by Yehyeong Lee of Hyundai Mobis. RESOLUTION ========== Applying the attached patch resolves this issue. xsa526-linux.patch Linux $ sha256sum xsa526* 88dd41b89b43fa1b14e68c1a40aa69a22309e0c57a1b5543168949a273627ca8 xsa526-linux.patch $ NOTE REGARDING LACK OF EMBARGO ============================== This issue was disclosed in public. -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrt7ssMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZq84H/02MP77ou0FS+9nAF8CWbGl79KfiUWO2xjXPEdKB Mgyzk0Gtq+Q0/oTaxPC59f9Pxc4yiCnGuIjpVM2qPOfaHZD0uEnzzGEROxVNCABq 7wCxZ/9Uu3MXO+1rcMgVqUNoHEqYLxgSp3OZ7O48DFQtkulP6fp4EgR0xTUIgPwn oKlWoSKORAXOkULt5Qn5xI0+YN0OgDMdHKj/BPkRIGeeqOHPRcUmeZU9VRnOiATh v1lR6erAWEx/dwr5Yq6ZReA6GFgDNRRk7ersnc5mwxxUyDtJtNXPHUCmE8AZ/q4C H2I/1SLzm6oa+v+0fngSasn9+lMZC6fzy0SxRJF3clRui+A= =uEqL -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa526-linux.patch" Content-Disposition: attachment; filename="xsa526-linux.patch" Content-Transfer-Encoding: base64 RnJvbTogSnVlcmdlbiBHcm9zcyA8amdyb3NzQHN1c2UuY29tPgpEYXRlOiBGcmksIDYgTm92IDIw MjYgMTM6MDc6NTIgKzAxMDAKU3ViamVjdDogW1BBVENIXSB4ZW4tbmV0YmFjazogRml4IFVBRiB3 aGVuIHJlYWRpbmcgc3RhdGlzdGljcyBkYXRhCgpUaGUgbmV0d29yayBzdGF0aXN0aWMgZGF0YSBp biB0aGUgZHJpdmVyIGlzIHByb3RlY3RlZCBieSBSQ1UuClVuZm9ydHVuYXRlbHkgd2hlbiB0ZWFy aW5nIGRvd24gdGhlIHF1ZXVlcyBhZnRlciBhbiBlcnJvciBkdXJpbmcKY29ubmVjdGluZyB0byB0 aGUgZnJvbnRlbmQgKGUuZy4gZHVlIHRvIGlsbGVnYWwgWGVuc3RvcmUgZGF0YSBmaWxsZWQKaW4g YnkgdGhlIGd1ZXN0KSwgdGhlIHN0YXRpc3RpYyBkYXRhIGlzIGJlaW5nIGZyZWVkIHdpdGhvdXQK c3luY2hyb25pemluZyB0aGUgUkNVIHN0YXRlLiAgSW4gY2FzZSB0aGUgZGF0YSBpcyBiZWluZyBy ZWFkIHZpYSBzeXNmcwppbiB0aGlzIHBoYXNlLCBhY2Nlc3MgdG8gYWxyZWFkeSBmcmVlZCBtZW1v cnkgb3IgbWVtb3J5IGJlaW5nIGluIG5ldwp1c2UgaXMgcG9zc2libGUuCgpGaXggdGhhdCBieSBj YWxsaW5nIHN5bmNocm9uaXplX25ldCgpIGJlZm9yZSBmcmVlaW5nIHRoZSBxdWV1ZSBkYXRhLgoK VGhpcyBpcyBYU0EtNTI2IC8gQ1ZFLTIwMjYtMTAwMDgwCgpGaXhlczogYjE3MDc1ZDVjMTk4ICgi eGVuLW5ldGJhY2s6IGZpeCByYWNlIGNvbmRpdGlvbiBvbiBYZW5CdXMgZGlzY29ubmVjdCIpClJl cG9ydGVkLWJ5OiBZZWh5ZW9uZyBMZWUgPHlobGVlQGlzc2xhYi5rb3JlYS5hYy5rcj4KU2lnbmVk LW9mZi1ieTogSnVlcmdlbiBHcm9zcyA8amdyb3NzQHN1c2UuY29tPgotLS0KIGRyaXZlcnMvbmV0 L3hlbi1uZXRiYWNrL3hlbmJ1cy5jIHwgMSArCiAxIGZpbGUgY2hhbmdlZCwgMSBpbnNlcnRpb24o KykKCmRpZmYgLS1naXQgYS9kcml2ZXJzL25ldC94ZW4tbmV0YmFjay94ZW5idXMuYyBiL2RyaXZl cnMvbmV0L3hlbi1uZXRiYWNrL3hlbmJ1cy5jCmluZGV4IGUwMjBmNDRhYzJjNy4uYzEwMzRkOGY2 YmYwIDEwMDY0NAotLS0gYS9kcml2ZXJzL25ldC94ZW4tbmV0YmFjay94ZW5idXMuYworKysgYi9k cml2ZXJzL25ldC94ZW4tbmV0YmFjay94ZW5idXMuYwpAQCAtODM3LDYgKzgzNyw3IEBAIHN0YXRp YyB2b2lkIGNvbm5lY3Qoc3RydWN0IGJhY2tlbmRfaW5mbyAqYmUpCiBlcnI6CiAJaWYgKGJlLT52 aWYtPm51bV9xdWV1ZXMgPiAwKQogCQl4ZW52aWZfZGlzY29ubmVjdF9kYXRhKGJlLT52aWYpOyAv KiBDbGVhbiB1cCBleGlzdGluZyBxdWV1ZXMgKi8KKwlzeW5jaHJvbml6ZV9uZXQoKTsKIAlmb3Ig KHF1ZXVlX2luZGV4ID0gMDsgcXVldWVfaW5kZXggPCBiZS0+dmlmLT5udW1fcXVldWVzOyArK3F1 ZXVlX2luZGV4KQogCQl4ZW52aWZfZGVpbml0X3F1ZXVlKCZiZS0+dmlmLT5xdWV1ZXNbcXVldWVf aW5kZXhdKTsKIAl2ZnJlZShiZS0+dmlmLT5xdWV1ZXMpOwotLSAKMi41Ni4wCgo= --=separator--