CVE-2026-45890
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, the xen-netback driver is vulnerable to a malicious or buggy Xen guest setting the 'multi-queue-num-queues' xenbus key to 0. The lack of lower bound validation causes a memory allocation with size 0, triggering a WARN_ON_ONCE and potentially leading to a denial of service (DoS) on systems with panic_on_warn enabled.
Risk Assessment
The risk is a guest-to-host denial of service attack that can crash the entire host if the system has panic_on_warn enabled.
Recommendation
Immediately update the Linux kernel to a version containing the fix that adds a zero check for the queue count, similar to the existing validation in the xen-blkback driver.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this allows a guest-to-host denial of service. The Xen network interface specification requires the queue count to be "greater than zero". Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added.