01 Record

CVE-2026-43249

9p/xen: protect xen_9pfs_front_free against concurrent calls

HighPUBLISHEDCNA: Linux

CNA base score8.8 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

9p/xen: protect xen_9pfs_front_free against concurrent calls

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.31% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 24.0% of scored records. A rank, not a probability.
NVD base score: 8.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-10-21.
Red Hat severity: Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-05-06 11:28Z5 MO AGO

Last updated

2026-10-21 12:40Z8 DAYS AGO

Reserved

2026-05-01

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.8)

CNA CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-415Double FreeVariant
CWE-364Signal Handler Race ConditionBase

Data version

5.2

Document digest

a86988f15419986eae5a60951bc7052b15e79287cd63063e83080df7b225f59b

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxc15fe55d14b3b4ded5af2a3260877460a6ffb8ad to < 480aa6ffd4ac7036eea042047d0cca71bc2074bb, c15fe55d14b3b4ded5af2a3260877460a6ffb8ad to < a5d00dff97118a32fcf5fec7a4c3f864c4620c4e, c15fe55d14b3b4ded5af2a3260877460a6ffb8ad to < 59e7707492576bdbfa8c1dbe7d90791df31e4773, c15fe55d14b3b4ded5af2a3260877460a6ffb8ad to < bf841d43f7a33d75675ba7f4e214ac1c67913065, c15fe55d14b3b4ded5af2a3260877460a6ffb8ad to < ce8ded2e61f47747e31eeefb44dc24a2160a7e32, be03c4fe72384366fd4077a70966bd3b8fc49013, 1ab4de11232e83b875b071aa44d1155634ca8a1e, 7cc9dbae8a5f73bd555130384ea256018d28f283, 3e0359f151ac151abe3fa71040e450ed69cb824b, 8d3fc907d060c4fb33203e616a395a22083b6566, 4f0e9244770f5b75a16d8c0929063cd336926764, 5f6a8974e9ef317fe63f88bab1f33070195dd147, 4.14.308 to < 4.15, 4.19.276 to < 4.20, 5.4.235 to < 5.5, 5.10.173 to < 5.11, 5.15.100 to < 5.16, 6.1.18 to < 6.2, 6.2.5 to < 6.3, 6.3—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/480aa6ffd4ac7036eea042047d0cca71bc2074bb
git.kernel.orghttps://git.kernel.org/stable/c/a5d00dff97118a32fcf5fec7a4c3f864c4620c4e
git.kernel.orghttps://git.kernel.org/stable/c/59e7707492576bdbfa8c1dbe7d90791df31e4773
git.kernel.orghttps://git.kernel.org/stable/c/bf841d43f7a33d75675ba7f4e214ac1c67913065
git.kernel.orghttps://git.kernel.org/stable/c/ce8ded2e61f47747e31eeefb44dc24a2160a7e32

07 Fixed in

Debian 12

linux
No fix yet

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.85-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.19.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.