Information

Files

Advisory

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

           Xen Security Advisory CVE-2026-100082 / XSA-528

 Linux xen-blkback: guest can trigger use-after-free for reading statistic data

ISSUE DESCRIPTION
=================

The driver does not serialise reads of the device I/O statistics
against the freeing of the memory that holds them. This leads to a
use-after-free when reading statistical counters while the device is
being torn down.

IMPACT
======

This most likely crashes the driver, and possibly the host, causing a
Denial of Service (DoS) for the entire host.

Information leaks cannot be ruled out.

VULNERABLE SYSTEMS
==================

Linux versions 4.5 and newer are vulnerable.

MITIGATION
==========

Using a userspace PV block backend (e.g. the qemu based "qdisk" backend)
will mitigate the problem.

Using a dedicated block driver domain per guest will mitigate the
problem.

CREDITS
=======

This issue was discovered by Yehyeong Lee of Hyundai Mobis.

RESOLUTION
==========

Applying the attached patch resolves this issue.

xsa528-linux.patch           Linux

$ sha256sum xsa528*
848d5cc56a7b31e84399ac00d616c36bd2b5efdcc0f23017a7590b1b58900c19  xsa528-linux.patch
$

NOTE REGARDING LACK OF EMBARGO
==============================

A very similar issue was disclosed in public.
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrt+FcMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZhk0IAIYo5FzilE5ZGPI8X2Wy1GVYncKZq/okta1YOUpI
dVI7k6om+7xkX9fwXtvDf5Sq5X73rWvAyP5wg3hxSZLoO0UdTVDJ3NhSJokTvcoi
Bl3XZsYgtwGb0un2i+YViSV91gPBBVX88al5/u64XmLpVCz5Z4IR8zsUuiV6pSEP
xxTALhFLR3hDR3irXLyrmvP/m9W9QB5BZCPWl8DD2hjHNbQmwpFatMFl+JGdR/9j
vfgbl8e1QqKkL1csbQ8omdpV1qkgF8O1q741Bb/HfIvNusPiJ0BK3TObcSZRb+7M
Fs68gSMjtwt1SetiIH+Q3X63x1XL4EZgBEVDLRZ+NtyY8nI=
=kad8
-----END PGP SIGNATURE-----