CVE-2026-45890

xen-netback: reject zero-queue configuration from guest

State: Published
Severity: Not scored
Published: May 27, 2026
Updated: May 27, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: reject zero-queue configuration from guest

A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range().

On systems with panic_on_warn=1, this allows a guest-to-host denial of service.

The Xen network interface specification requires the queue count to be "greater than zero".

Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before 2993e0f904c45f8af12917344bb1cac7ccd05a60Affected 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before 787bfa423228c4b02ba3368128f625d579085353Affected 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before ce66d6786de45b7ed9cbbdc0988054bf09e58f54Affected 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before 88b0fced1bbbfdb356a007592604008ffc93a6a1Affected 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before ec4859ac5c933e3315543a61adc1ca4358006a41Affected 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before 654780dee9eae419e1648ea58462c4efe54518faAffected 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before d99f69ddc70fd9f4b8148add62209a1a8eb5c615Affected 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before 6d1dc8014334c7fb25719999bca84d811e60a559Affected
LinuxLinux	3.16Affected before 3.16Not affected 5.10.252 through 5.10.Not affected 5.15.202 through 5.15.Not affected 6.1.165 through 6.1.Not affected 6.6.128 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.14 through 6.18.Not affected 6.19.4 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before 2993e0f904c45f8af12917344bb1cac7ccd05a60Affected
8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before 787bfa423228c4b02ba3368128f625d579085353Affected
8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before ce66d6786de45b7ed9cbbdc0988054bf09e58f54Affected
8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before 88b0fced1bbbfdb356a007592604008ffc93a6a1Affected
8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before ec4859ac5c933e3315543a61adc1ca4358006a41Affected
8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before 654780dee9eae419e1648ea58462c4efe54518faAffected
8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before d99f69ddc70fd9f4b8148add62209a1a8eb5c615Affected
8d3d53b3e43363e79ab9a9ecc149b06c1314b25d to before 6d1dc8014334c7fb25719999bca84d811e60a559Affected

LinuxLinux

3.16Affected
before 3.16Not affected
5.10.252 through 5.10.*Not affected
5.15.202 through 5.15.*Not affected
6.1.165 through 6.1.*Not affected
6.6.128 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.14 through 6.18.*Not affected
6.19.4 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.