CVE-2026-100082

Not scored yetLast modified Nov 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xen-blkback: Avoid UAF when reading I/O statistics

Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading of the statistics data is not synchronized with freeing the data.

Use a rwlock for synchronizing.

This is XSA-528 / CVE-2026-100082

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 6, 2026
Last modified
Nov 13, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-100097.5Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execCVE-2026-10014.8Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality ofCVE-2026-100105.0Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the CVE-2026-1001029.5Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to thiCVE-2026-10010310.0Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauCVE-2026-1001043.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 thCVE-2026-1001057.7A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destinCVE-2026-1001066.4The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' paraCVE-2026-1001077.2The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up tCVE-2026-1001086.4The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter iCVE-2026-1001099.8The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an actionCVE-2026-100113.1Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pro
CVE-2026-100082: Unscored | Vulnix