CVE-2026-100081 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()). Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect(). This is XSA-527 / CVE-2026-100081.

Is your site exposed to CVE-2026-100081?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0017

Probability of exploitation

0.06%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1 https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99 https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515 https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db https://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62 https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff http://www.openwall.com/lists/oss-security/2026/11/06/10 http://xenbits.xen.org/xsa/advisory-527.html

Frequently Asked Questions

What is CVE-2026-100081? +

In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()). Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect(). This is XSA-527 / CVE-2026-100081. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-100081? +

CVE-2026-100081 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0017, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-100081? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-100081