In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this allows a guest-to-host denial of service. The Xen network interface specification requires the queue count to be "greater than zero". Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/2993e0f904c45f8af12917344bb1cac7ccd05a60 cve-icon cve-icon
https://git.kernel.org/stable/c/654780dee9eae419e1648ea58462c4efe54518fa cve-icon cve-icon
https://git.kernel.org/stable/c/6d1dc8014334c7fb25719999bca84d811e60a559 cve-icon cve-icon
https://git.kernel.org/stable/c/787bfa423228c4b02ba3368128f625d579085353 cve-icon cve-icon
https://git.kernel.org/stable/c/88b0fced1bbbfdb356a007592604008ffc93a6a1 cve-icon cve-icon
https://git.kernel.org/stable/c/ce66d6786de45b7ed9cbbdc0988054bf09e58f54 cve-icon cve-icon
https://git.kernel.org/stable/c/d99f69ddc70fd9f4b8148add62209a1a8eb5c615 cve-icon cve-icon
https://git.kernel.org/stable/c/ec4859ac5c933e3315543a61adc1ca4358006a41 cve-icon cve-icon
History

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this allows a guest-to-host denial of service. The Xen network interface specification requires the queue count to be "greater than zero". Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added.
Title xen-netback: reject zero-queue configuration from guest
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-27T12:17:01.466Z

Reserved: 2026-05-13T15:03:33.083Z

Link: CVE-2026-45890

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:03.040

Modified: 2026-05-27T14:48:31.480

Link: CVE-2026-45890

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.