Use-after-free in Linux kernel - CVE-2026-100081
Published: November 6, 2026
Vulnerability identifier: #VU159855
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100081
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to potentially cause a denial of service through access to freed kernel memory.
The vulnerability exists due to use-after-free in the Linux kernel xen-netback multicast address list handling when interface disconnection overlaps with transmit or receive processing. A local user can trigger concurrent network processing and interface disconnection to potentially cause active processing to access freed list entries and crash the kernel.
Affected software
Linux kernel
How to mitigate CVE-2026-100081
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c
- https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1
- https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99
- https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515
- https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db
- https://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62
- https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff
- http://www.openwall.com/lists/oss-security/2026/11/06/10
- http://xenbits.xen.org/xsa/advisory-527.html