CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: Zero out sring pointers on unmap

If xenvif_map_frontend_data_rings() fails when a ring is already mapped, it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the ring pointers unchanged. xenvif_connect_data()'s cleanup path calls xenvif_disconnect_queue() which in turn calls xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the pointers a second time.

Zero out the ring pointers after they are unmapped to avoid this issue.

This is XSA-532