PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45890 Linux CVE debrief

A vulnerability in the Linux kernel's Xen network backend (xen-netback) allowed malicious or buggy Xen guests to trigger a kernel warning by setting the multi-queue configuration to zero. The connect() function validated only the upper bound of requested queue counts, permitting a zero-queue configuration to reach vzalloc() with a zero size argument. This triggered WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems configured with panic_on_warn=1, this warning would cause a kernel panic, resulting in guest-to-host denial of service. The Xen network interface specification requires queue counts greater than zero. The fix adds a zero check to align with existing validation in xen-blkback.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Organizations running Xen virtualization infrastructure with Linux kernel-based dom0 hosts, particularly those with panic_on_warn enabled or hosting untrusted guest workloads

Technical summary

The xen-netback driver in the Linux kernel failed to validate that the requested number of queues was greater than zero when processing guest multi-queue configuration via xenbus. A zero value passed through to vzalloc() triggered a kernel warning via WARN_ON_ONCE. Systems with panic_on_warn enabled would experience kernel panics, allowing malicious guests to cause host denial of service. The vulnerability was fixed by adding a zero check matching the validation pattern already present in xen-blkback.

Defensive priority

medium

Recommended defensive actions

  • Apply the relevant kernel patch from the stable kernel git repository to affected systems running Xen with xen-netback
  • Review and update kernel configurations to ensure panic_on_warn is not enabled on production virtualization hosts unless specifically required
  • Audit Xen guest configurations to ensure compliance with the Xen network interface specification requiring queue counts greater than zero
  • Monitor kernel logs for WARN_ON_ONCE messages from __vmalloc_node_range that may indicate exploitation attempts
  • Consider implementing additional input validation at the virtualization management layer to prevent zero-queue configurations from reaching the backend

Evidence notes

The vulnerability description indicates this was resolved in the Linux kernel with a patch that adds zero-queue validation to xen-netback's connect() function. Multiple stable kernel branches received backports. The issue affects Xen virtualization environments where guests can manipulate the multi-queue-num-queues xenbus key.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45890 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45890

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45890 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45890

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2993e0f904c45f8af12917344bb1cac7ccd05a60

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/654780dee9eae419e1648ea58462c4efe54518fa

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6d1dc8014334c7fb25719999bca84d811e60a559

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/787bfa423228c4b02ba3368128f625d579085353

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/88b0fced1bbbfdb356a007592604008ffc93a6a1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ce66d6786de45b7ed9cbbdc0988054bf09e58f54

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d99f69ddc70fd9f4b8148add62209a1a8eb5c615

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.