CVE-2026-99287

NameCVE-2026-99287
DescriptionIn the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvif_map_frontend_data_rings() fails when a ring is already mapped, it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the ring pointers unchanged. xenvif_connect_data()'s cleanup path calls xenvif_disconnect_queue() which in turn calls xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the pointers a second time. Zero out the ring pointers after they are unmapped to avoid this issue. This is XSA-532
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4906-1, DSA-6628-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)bookworm6.1.176-1vulnerable
bookworm (security)6.1.192-1fixed
trixie6.12.107-1vulnerable
trixie (security)6.12.117-1fixed
forky7.2.15-1vulnerable
sid7.3.4-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcebookworm6.1.192-1DLA-4906-1
linuxsourcetrixie6.12.117-1DSA-6628-1
linuxsource(unstable)7.3.4-1

Notes

https://xenbits.xen.org/xsa/advisory-532.html

Search for package or bug name: Reporting problems