Description
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.5.0 – < unspecified | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.10.46-1 | — |
| Debian 13 | linux | 5.10.46-1 | — |
| Debian 12 | linux | 5.10.46-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-aws-5.11 +1 | 5.11.0-1016.17~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-aws-5.8 | 5.8.0-1042.44~20.04.1 | USN-5050-1 |
| Ubuntu 20.04 LTS | linux-azure-5.11 | 5.11.0-1013.14~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure-5.8 | 5.8.0-1040.43~20.04.1 | USN-5050-1 |
| Ubuntu 20.04 LTS | linux-gcp-5.11 | 5.11.0-1017.19~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.8 | 5.8.0-1039.41 | USN-5050-1 |
| Ubuntu 20.04 LTS | linux-hwe-5.11 | 5.11.0-34.36~20.04.1 | USN-5046-1 |
| Ubuntu 20.04 LTS | linux-oem-5.10 | 5.10.0-1038.40 | USN-5015-1 |
| Ubuntu 20.04 LTS | linux-oracle-5.8 | 5.8.0-1038.39~20.04.1 | USN-5050-1 |
| Ubuntu 20.04 LTS | linux-riscv +4 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-riscv-5.11 | 5.11.0-1017.18~20.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +13 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | kernel | 5.10.78.1-1 | — |
Advisories 3
- USN-5015-1 linux-oem-5.10 vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- USN-5046-1 linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.11, linux-kvm, linux-oracle, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- USN-5050-1 linux-aws-5.8, linux-azure-5.8, linux-gcp-5.8, linux-oracle-5.8 vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026