CVE-2026-45890
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
xen-netback: reject zero-queue configuration from guest
In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this allows a guest-to-host denial of service. The Xen network interface specification requires the queue count to be "greater than zero". Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d | affected | git | 2993e0f904c45f8af12917344bb1cac7ccd05a60 | Unavailable | None listed |
| 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d | affected | git | 787bfa423228c4b02ba3368128f625d579085353 | Unavailable | None listed |
| 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d | affected | git | ce66d6786de45b7ed9cbbdc0988054bf09e58f54 | Unavailable | None listed |
| 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d | affected | git | 88b0fced1bbbfdb356a007592604008ffc93a6a1 | Unavailable | None listed |
| 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d | affected | git | ec4859ac5c933e3315543a61adc1ca4358006a41 | Unavailable | None listed |
| 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d | affected | git | 654780dee9eae419e1648ea58462c4efe54518fa | Unavailable | None listed |
| 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d | affected | git | d99f69ddc70fd9f4b8148add62209a1a8eb5c615 | Unavailable | None listed |
| 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d | affected | git | 6d1dc8014334c7fb25719999bca84d811e60a559 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 3.16 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 3.16 | Unavailable | None listed |
| 5.10.252 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.202 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.165 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.128 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.75 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.14 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 6.19.4 | unaffected | semver | Unavailable | 6.19.* | None listed |
| 7.0 | unaffected | original_commit_for_fix | Unavailable | * | None listed |