# CVE-2026-100082: Linux kernel xen-blkback UAF in I/O statistics read

Source: https://junglewise.ai/threats/cve-2026-100082-in-the-linux-kernel-the-following-vulnerability-has-been  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-100082 · Severity: info · Published 2026-11-06

The Linux kernel's xen-blkback driver, which manages block device I/O for Xen virtualization, had a race condition where reading I/O statistics via sysfs could occur simultaneously with device teardown, causing a use-after-free or NULL pointer dereference. An attacker with local access to sysfs could trigger this condition, potentially causing a denial of service or kernel crash.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-100082 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100082 being exploited in the wild.

**How severe is CVE-2026-100082?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** Linux Kernel before fix commit a02926f7c89bfc798ee9514e09694ff4279928a1.

**Is there a fix for CVE-2026-100082?** A patch was published on 2026-11-06. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100082 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-100082?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the xen-blkback driver when I/O statistics are read from sysfs concurrently with frontend device disconnection. The statistics reading function does not synchronize access to the ring data structures, which can be freed during device teardown. The fix introduces a reader-writer lock (rwlock) to protect concurrent access to the rings pointer and nr_rings field.

## Affected products

- Linux Linux kernel before fix commit a02926f7c89bfc798ee9514e09694ff4279928a1

## Timeline

- 2026-11-06: disclosed
- 2026-11-06: patched

## References

- [https://git.kernel.org/stable/c/253cff0526781e28b1b0f9fdacd74ecdc23d3ab7](https://git.kernel.org/stable/c/253cff0526781e28b1b0f9fdacd74ecdc23d3ab7)
- [https://git.kernel.org/stable/c/2c9ccbe0ffcff3615c7ad917c49b67571a41f21c](https://git.kernel.org/stable/c/2c9ccbe0ffcff3615c7ad917c49b67571a41f21c)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)