https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 17:08:45 +0000 https://vulnerability.circl.lu/vuln/cve-2026-45890 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xen-netback: reject zero-queue configuration from guest</p> <p>A malicious or buggy Xen guest can write &#34;0&#34; to the xenbus key &#34;multi-queue-num-queues&#34;. The connect() function in the backend only validates the upper bound (requested_num_queues &gt; xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range().</p> <p>On systems with panic_on_warn=1, this allows a guest-to-host denial of service.</p> <p>The Xen network interface specification requires the queue count to be &#34;greater than zero&#34;.</p> <p>Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xen-netback: reject zero-queue configuration from guest</p> <p>A malicious or buggy Xen guest can write &#34;0&#34; to the xenbus key &#34;multi-queue-num-queues&#34;. The connect() function in the backend only validates the upper bound (requested_num_queues &gt; xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range().</p> <p>On systems with panic_on_warn=1, this allows a guest-to-host denial of service.</p> <p>The Xen network interface specification requires the queue count to be &#34;greater than zero&#34;.</p> <p>Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added.</p> https://vulnerability.circl.lu/vuln/cve-2026-45890