PT-2026-43757 · Linux · Linux
Published
2026-05-27
·
Updated
2026-05-27
·
CVE-2026-45890
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
xen-netback: reject zero-queue configuration from guest
A malicious or buggy Xen guest can write "0" to the xenbus key
"multi-queue-num-queues". The connect() function in the backend only
validates the upper bound (requested num queues > xenvif max queues)
but not zero, allowing requested num queues=0 to reach
vzalloc(array size(0, sizeof(struct xenvif queue))), which triggers
WARN ON ONCE(!size) in vmalloc node range().
On systems with panic on warn=1, this allows a guest-to-host denial
of service.
The Xen network interface specification requires
the queue count to be "greater than zero".
Add a zero check to match the validation already present
in xen-blkback, which has included this
guard since its multi-queue support was added.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux