cve.bz

CVE-2026-99286 xen-netback: Fix XenBus connection failure cleanup

no score yetEPSS 0.2%Fix available

linux linux: no CVSS score yet. EPSS 0.2% estimated probability of exploitation activity in the next 30 days.

On this page
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues under rcu_read_lock. We need to unpublish vif->num_queues before synchronize_net to ensure that readers that come afterwards will not read a non-zero vif->num_queues and attempt to access invalid queues. This is the same cleanup algorithm as used in backend_disconnect and added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect"). This is XSA-531
EPSS
0.2% estimated probability of exploitation activity in the next 30 days; 7th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
Published
Modified
Assigned by
Linux (CNA)
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-99286 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-99286?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-99286?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-99286 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

CVE-2026-99286

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-99286](https://cve.bz/cve/badge/CVE-2026-99286.svg)](https://cve.bz/cve/CVE-2026-99286)

HTML:

<a href="https://cve.bz/cve/CVE-2026-99286"><img src="https://cve.bz/cve/badge/CVE-2026-99286.svg" alt="CVE-2026-99286"></a>

Affected

Versions

From the CNA's record in the CVE List.

ProductAffected
Linuxfrom 6.12.116 before 6.12.117
Linuxfrom 6.18.62 before 6.18.63
Linuxfrom 7.3.3 before 7.3.4
Linuxfrom 5.10.274 before 5.11
Linuxfrom 5.15.225 before 5.16
Linuxfrom 6.1.192 before 6.2
Linuxfrom 6.6.162 before 6.7
Linux7.4-rc2 and later

Fixed in

ProductRelease lineFixed in
Linux6.126.12.117
Linux6.186.18.63
Linux7.37.3.4

Fix and patched versions

Linux distributions

DistributionReleasePackageFixed inAdvisory
Debian12, 14linuxno fix listedDEBIAN-CVE-2026-99286
Debian13linux6.12.117-1DEBIAN-CVE-2026-99286
Ubuntu16.04:LTSlinux-hwe-edgeno fix listedUBUNTU-CVE-2026-99286
Ubuntu18.04:LTSlinux-gcp, linux-hwe, linux-oem and 12 moreno fix listedUBUNTU-CVE-2026-99286
Ubuntu20.04:LTSlinux-gke, linux-gkeop, linux-riscv and 26 moreno fix listedUBUNTU-CVE-2026-99286
Ubuntu22.04:LTSlinux, linux-aws, linux-gcp and 57 moreno fix listedUBUNTU-CVE-2026-99286
Ubuntu24.04:LTSlinux, linux-aws, linux-gcp and 50 moreno fix listedUBUNTU-CVE-2026-99286
Ubuntu26.04:LTSlinux, linux-aws, linux-gcp and 12 moreno fix listedUBUNTU-CVE-2026-99286
Ubuntu26.10linux, linux-aws, linux-gcp and 6 moreno fix listedUBUNTU-CVE-2026-99286
UbuntuNvidia-BlueField:22.04:LTS, Nvidia-BlueField:24.04:LTSlinux-bluefieldno fix listedUBUNTU-CVE-2026-99286
UbuntuPro:14.04:LTSlinux, linux-aws, linux-azure and 1 moreno fix listedUBUNTU-CVE-2026-99286
UbuntuPro:16.04:LTSlinux, linux-aws, linux-gcp and 5 moreno fix listedUBUNTU-CVE-2026-99286
UbuntuPro:18.04:LTSlinux, linux-aws, linux-kvm and 10 moreno fix listedUBUNTU-CVE-2026-99286
UbuntuPro:20.04:LTSlinux, linux-aws, linux-gcp and 19 moreno fix listedUBUNTU-CVE-2026-99286
4 more for Ubuntu in the JSON and on Ubuntu's page.
Azure Linux3kernelno fix listedAZL-113314
Alpaquita23, 25, streamlinux-ltsno fix listedBELL-CVE-2026-99286

From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0; Microsoft's Azure Linux vulnerability data, MIT; BellSoft's OSV database, MIT. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu · Alpaquita.

References

Check your stackJSON