Commit 5fb756f1bbec for kernel

commit 5fb756f1bbec7a3862dda5d79028bf656271804c
Author: Juergen Gross <jgross@suse.com>
Date:   Fri Nov 6 13:07:52 2026 +0100

    xen-netback: Fix UAF when reading statistics data

    The network statistic data in the driver is protected by RCU.
    Unfortunately when tearing down the queues after an error during
    connecting to the frontend (e.g. due to illegal Xenstore data filled
    in by the guest), the statistic data is being freed without
    synchronizing the RCU state.  In case the data is being read via sysfs
    in this phase, access to already freed memory or memory being in new
    use is possible.

    Fix that by calling synchronize_net() before freeing the queue data.

    This is XSA-526 / CVE-2026-100080

    Reported-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
    Signed-off-by: Juergen Gross <jgross@suse.com>

diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index e020f44ac2c7..c1034d8f6bf0 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -837,6 +837,7 @@ static void connect(struct backend_info *be)
 err:
 	if (be->vif->num_queues > 0)
 		xenvif_disconnect_data(be->vif); /* Clean up existing queues */
+	synchronize_net();
 	for (queue_index = 0; queue_index < be->vif->num_queues; ++queue_index)
 		xenvif_deinit_queue(&be->vif->queues[queue_index]);
 	vfree(be->vif->queues);