commit d50d994bffa3c7c6db2d8bc4c5f0c55e3f46b0cd
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Nov 6 13:18:30 2026 -0500

    Linux 7.3.3
    
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b0378161c28e77e4d0e2eda3c9433ab4394d2a2f
Author: Juergen Gross <jgross@suse.com>
Date:   Thu Nov 5 08:27:38 2026 +0100

    xen-blkback: Avoid UAF when reading I/O statistics
    
    commit a02926f7c89bfc798ee9514e09694ff4279928a1 upstream.
    
    Reading I/O statistics via sysfs concurrently with tearing down a
    frontend device might result in UAF or a NULL dereference, as the
    reading of the statistics data is not synchronized with freeing the
    data.
    
    Use a rwlock for synchronizing.
    
    This is XSA-528 / CVE-2026-100082
    
    Fixes: db6fbc106786 ("xen/blkback: make st_ statistics per ring")
    Reported-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Acked-by: Roger Pau Monné <roger@xenproject.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fb38fc58acb26d74fe8f7b19621fafaae3c040ff
Author: Jan Beulich <jbeulich@suse.com>
Date:   Fri Nov 6 17:07:01 2026 +0100

    xen-netback: defer xenvif_mcast_addr_list_free()
    
    commit bfddc420afe827d9f06458cdf8087cd602f8c9cb upstream.
    
    In order for the function to legitimately avoid locking/RCU, it needs to
    run after all TX/RX processing has finished/stopped: Lookups happen from
    xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
    (called out of xenvif_poll()).
    
    Move the call out of xenvif_disconnect_data() (the call to the function
    from connect()'s error path doesn't require any cleaning up there), and
    put it past the synchronization point in backend_disconnect().
    
    This is XSA-527 / CVE-2026-100081.
    
    Fixes: b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect")
    Reported-by: kerhunt <kerhunt@proton.me>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4867687b6ad28ab84bc0811d8f8f9972e769da02
Author: Juergen Gross <jgross@suse.com>
Date:   Fri Nov 6 13:07:52 2026 +0100

    xen-netback: Fix UAF when reading statistics data
    
    commit 5fb756f1bbec7a3862dda5d79028bf656271804c upstream.
    
    The network statistic data in the driver is protected by RCU.
    Unfortunately when tearing down the queues after an error during
    connecting to the frontend (e.g. due to illegal Xenstore data filled
    in by the guest), the statistic data is being freed without
    synchronizing the RCU state.  In case the data is being read via sysfs
    in this phase, access to already freed memory or memory being in new
    use is possible.
    
    Fix that by calling synchronize_net() before freeing the queue data.
    
    This is XSA-526 / CVE-2026-100080
    
    Reported-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>