Use-After-Free Vulnerability in Linux Kernel Affecting Xen-blkback

CVE-2026-100082

What is CVE-2026-100082?

A vulnerability exists in the Linux kernel's xen-blkback module that can lead to a use-after-free or NULL dereference when reading I/O statistics via sysfs while simultaneously tearing down a frontend device. This occurs because the process of gathering statistics is not adequately synchronized with the freeing of associated data. Implementing a read-write lock (rwlock) provides the necessary synchronization to mitigate this security risk.

References