{"id":"AZL-113314","summary":"CVE-2026-99286 affecting package kernel 6.6.161.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Fix XenBus connection failure cleanup\n\nxenvif_get_stats and xenvif_get_ethtool_stats capture vif-\u003enum_queues\nunder rcu_read_lock. We need to unpublish vif-\u003enum_queues before\nsynchronize_net to ensure that readers that come afterwards will not\nread a non-zero vif-\u003enum_queues and attempt to access invalid queues.\n\nThis is the same cleanup algorithm as used in backend_disconnect and\nadded in commit b17075d5c198 (\"xen-netback: fix race condition on XenBus\ndisconnect\").\n\nThis is XSA-531","modified":"2026-11-11T14:17:33.135054526Z","published":"2026-11-10T19:22:31Z","upstream":["CVE-2026-99286"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99286"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.161.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113314.json"}}],"schema_version":"1.9.2"}