Race condition in Linux kernel - CVE-2026-99286

Vulnerability details

The vulnerability allows a local user to potentially cause a denial of service by triggering invalid memory access in the Linux kernel.

The vulnerability exists due to a race condition in Xen netback connection failure cleanup when queue statistics are read concurrently with queue deallocation. A local user can potentially trigger overlapping connection failure cleanup and statistics collection to cause statistics readers to access freed queue memory, potentially crashing the kernel.

Affected software

How to mitigate CVE-2026-99286

External References

• https://git.kernel.org/stable/c/07aca7d25ce8578fedde49855983a01c537a782b
• https://git.kernel.org/stable/c/a97aa838903d15f865d80809f5198ff459c6634a
• https://git.kernel.org/stable/c/ade3082dcdee17c5767069883936d64ff83f6c9f

Related Security Bulletins

• Race condition in Linux kernel net xen-netback driver
• Debian update for linux