Medium 5.5Published May 27, 2026

CVE-2026-45890xen-netback: reject zero-queue configuration from guest

Updated under an hour ago (Oct 26, 2026, 3:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this allows a guest-to-host denial of service. The Xen network interface specification requires the queue count to be "greater than zero". Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d before 2993e0f904c45f8af12917344bb1cac7ccd05a60; from 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d before 787bfa423228c4b02ba3368128f625d579085353; from 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d before ce66d6786de45b7ed9cbbdc0988054bf09e58f54; from 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d before 88b0fced1bbbfdb356a007592604008ffc93a6a1; from 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d before ec4859ac5c933e3315543a61adc1ca4358006a41; from 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d before 654780dee9eae419e1648ea58462c4efe54518fa; from 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d before d99f69ddc70fd9f4b8148add62209a1a8eb5c615; 8d3d53b3e43363e79ab9a9ecc149b06c1314b25d builds before 6d1dc8014334c7fb25719999bca84d811e60a559	CNA record
linux linux_kernel linux:linux_kernel	from 3.16 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4	NVD

References

References

https://git.kernel.org/stable/c/2993e0f904c45f8af12917344bb1cac7ccd05a60	patch
https://git.kernel.org/stable/c/787bfa423228c4b02ba3368128f625d579085353	patch
https://git.kernel.org/stable/c/ce66d6786de45b7ed9cbbdc0988054bf09e58f54	patch
https://git.kernel.org/stable/c/88b0fced1bbbfdb356a007592604008ffc93a6a1	patch
https://git.kernel.org/stable/c/ec4859ac5c933e3315543a61adc1ca4358006a41	patch
https://git.kernel.org/stable/c/654780dee9eae419e1648ea58462c4efe54518fa	patch
https://git.kernel.org/stable/c/d99f69ddc70fd9f4b8148add62209a1a8eb5c615	patch
https://git.kernel.org/stable/c/6d1dc8014334c7fb25719999bca84d811e60a559	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.