Linux Kernel EUVD-2026-27808

Requires Linux kernel with CONFIG_NET_9P_XEN enabled (Xen 9P filesystem transport compiled into kernel or loaded as module). The Xen 9P front-end driver must be actively in use with a configured back-end connection between Xen domains at the time of attack. Attacker must have adjacent network access (AV:A) to the Xen host's control plane network to trigger xenbus state change events. Most limiting factor: the Xen 9P transport is a specialized feature not enabled in default kernel configurations and only relevant in Xen virtualization deployments using Plan 9-style filesystem sharing, significantly reducing the population of vulnerable systems compared to mainline kernel installations.

CVSS 8.8 (High) reflects adjacent network attack vector (AV:A), low complexity (AC:L), and no required privileges (PR:N), with high confidentiality, integrity, and availability impact. However, real-world risk is significantly constrained by specific deployment requirements. The adjacent network vector means the attacker must be on the same network segment as the Xen host and target a system actively using the Xen 9P transport - a relatively niche configuration compared to mainstream filesystems. EPSS exploitation probability of 0.02% (5th percentile) aligns with this assessment: while technically severe for affected systems, the limited deployment footprint and requirement for Xen virtualization reduce widespread exploitation likelihood. No CISA KEV listing or public POC identified, suggesting no confirmed active exploitation. SSVC decision factors: exploitation status is none (no evidence of active use), automatable is yes (network-reachable race condition), technical impact is total (kernel panic/arbitrary code execution). For organizations NOT running Xen 9P filesystems, this is non-applicable. For Xen environments using 9P transport between domains, this is a critical priority requiring immediate patching due to potential kernel compromise from adjacent attackers.

An attacker on the same network segment as a Xen virtualization host running vulnerable Linux kernel with 9P transport enabled sends crafted Xen backend state change notifications to the xenwatch thread. By timing multiple notifications to trigger concurrent calls to xen_9pfs_front_free() during device teardown, the attacker induces a double-free condition in kernel memory. The use-after-free corruption causes a general protection fault, crashing the kernel (denial of service). In advanced scenarios, the attacker could potentially leverage heap manipulation techniques to control the freed memory contents, achieving arbitrary kernel code execution and full host compromise. No public proof-of-concept identified at time of analysis, but the race condition is reproducible based on crash report evidence.