CVE-2026-99287
Published Nov 10, 2026
Modified Nov 10, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvif_map_frontend_data_rings() fails when a ring is already mapped, it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the ring pointers unchanged. xenvif_connect_data()'s cleanup path calls xenvif_disconnect_queue() which in turn calls xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the pointers a second time. Zero out the ring pointers after they are unmapped to avoid this issue. This is XSA-532
Is your site exposed to CVE-2026-99287?
Run a free security scan — no signup, results in seconds.
References
Other References
https://git.kernel.org/stable/c/87fd475dc4e354088f6534285388e7b061f54b35
https://git.kernel.org/stable/c/c5f54af611ff6fe1d53fa05d8e87b469dc56122b
https://git.kernel.org/stable/c/e7ba61734d6ad6adfd5bf617052e590743211669
http://www.openwall.com/lists/oss-security/2026/11/10/26
http://xenbits.xen.org/xsa/advisory-532.html
Frequently Asked Questions
What is CVE-2026-99287? +
In the Linux kernel, the following vulnerability has been resolved:
xen-netback: Zero out sring pointers on unmap
If xenvif_map_frontend_data_rings() fails when a ring is already mapped,
it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the
ring pointers unchanged. xenvif_connect_data()'s cleanup path calls
xenvif_disconnect_queue() which in turn calls
xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the
pointers a second time.
Zero out the ring pointers after they are unmapped to avoid this issue.
This is XSA-532
How do I check if I'm vulnerable to CVE-2026-99287? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.
