PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45890 Linux CVE debrief

A vulnerability in the Linux kernel's Xen network backend (xen-netback) allowed malicious or buggy Xen guests to trigger a kernel warning by setting the multi-queue configuration to zero. The connect() function validated only the upper bound of requested queue counts, permitting a zero-queue configuration to reach vzalloc() with a zero size argument. This triggered WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems configured with panic_on_warn=1, this warning would cause a kernel panic, resulting in guest-to-host denial of service. The Xen network interface specification requires queue counts greater than zero. The fix adds a zero check to align with existing validation in xen-blkback.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Xen virtualization infrastructure with Linux kernel-based dom0 hosts, particularly those with panic_on_warn enabled or hosting untrusted guest workloads

Technical summary

The xen-netback driver in the Linux kernel failed to validate that the requested number of queues was greater than zero when processing guest multi-queue configuration via xenbus. A zero value passed through to vzalloc() triggered a kernel warning via WARN_ON_ONCE. Systems with panic_on_warn enabled would experience kernel panics, allowing malicious guests to cause host denial of service. The vulnerability was fixed by adding a zero check matching the validation pattern already present in xen-blkback.

Defensive priority

medium

Recommended defensive actions

  • Apply the relevant kernel patch from the stable kernel git repository to affected systems running Xen with xen-netback
  • Review and update kernel configurations to ensure panic_on_warn is not enabled on production virtualization hosts unless specifically required
  • Audit Xen guest configurations to ensure compliance with the Xen network interface specification requiring queue counts greater than zero
  • Monitor kernel logs for WARN_ON_ONCE messages from __vmalloc_node_range that may indicate exploitation attempts
  • Consider implementing additional input validation at the virtualization management layer to prevent zero-queue configurations from reaching the backend

Evidence notes

The vulnerability description indicates this was resolved in the Linux kernel with a patch that adds zero-queue validation to xen-netback's connect() function. Multiple stable kernel branches received backports. The issue affects Xen virtualization environments where guests can manipulate the multi-queue-num-queues xenbus key.

Official resources

2026-05-27