CVE-2026-45890

xen-netback: reject zero-queue configuration from guest

MEDIUM

5.5

CVSS Score

Published: May 27, 2026 at 12:17 PM UTC

Updated: June 27, 2026 at 11:41 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this allows a guest-to-host denial of service. The Xen network interface specification requires the queue count to be "greater than zero". Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

3.16 ≤ v < 5.10.2523.16 ≤ v < 5.15.2023.16 ≤ v < 6.1.1653.16 ≤ v < 6.12.753.16 ≤ v < 6.18.143.16 ≤ v < 6.19.43.16 ≤ v < 6.6.1283.16 ≤ v < 7.05.11 ≤ v < 5.15.2025.16 ≤ v < 6.1.1656.13 ≤ v < 6.18.146.19 ≤ v < 6.19.46.2 ≤ v < 6.6.1286.7 ≤ v < 6.12.753.168d3d53b3e43363e79ab9a9ecc149b06c1314b25d

Vendor states this is fixed in 2993e0f904c45f8af12917344bb1cac7ccd05a60 (fixed)

Vendor states this is fixed in 654780dee9eae419e1648ea58462c4efe54518fa (fixed)

Vendor states this is fixed in 6d1dc8014334c7fb25719999bca84d811e60a559 (fixed)

Vendor states this is fixed in 787bfa423228c4b02ba3368128f625d579085353 (fixed)

Vendor states this is fixed in 88b0fced1bbbfdb356a007592604008ffc93a6a1 (fixed)

Vendor states this is fixed in ce66d6786de45b7ed9cbbdc0988054bf09e58f54 (fixed)

Vendor states this is fixed in d99f69ddc70fd9f4b8148add62209a1a8eb5c615 (fixed)

Vendor states this is fixed in ec4859ac5c933e3315543a61adc1ca4358006a41 (fixed)

Vendor states this is fixed in 3.16 (unaffected)

Vendor states this is fixed in 5.10.252 (unaffected)

Vendor states this is fixed in 5.15.202 (unaffected)

Vendor states this is fixed in 6.1.165 (unaffected)