Linux stable kernels 7.3.3, 6.18.62, 6.12.116 and four older series patch three Xen use-after-free flaws

Greg Kroah-Hartman released seven stable Linux kernels—7.3.3, 6.18.62, 6.12.116, 6.6.162, 6.1.192, 5.15.225, and 5.10.274—each containing only fixes for three Xen-related use-after-free vulnerabilities announced the same day. Two of the flaws, CVE-2026-100080 and CVE-2026-100082, could enable an attacker to trigger a denial of service against the entire Xen host with potential information leakage. The third, CVE-2026-100081, carries the additional risk of privilege escalation alongside host DoS.

The releases span kernel versions from the current 7.x series back to 5.10, ensuring coverage for long-term support deployments still running older branches. Because the patches are narrowly scoped to Xen subsystem fixes, administrators can assess upgrade urgency based on whether their infrastructure runs Xen virtualization. Non-Xen users face no direct exposure from these particular flaws.

Xen vulnerability scope and kernel coverage

• Vulnerability class: All three flaws are use-after-free bugs in the Xen subsystem, a memory safety issue where freed heap memory is subsequently accessed, leading to undefined behavior exploitable for code execution or crash induction.
• CVE-2026-100080 and CVE-2026-100082: These two vulnerabilities allow denial of service against the entire Xen host machine, with possible information leakage as a secondary impact; they do not permit privilege escalation.
• CVE-2026-100081: This flaw is the most severe of the three, permitting both privilege escalation and host-wide denial of service, giving an attacker potential control over the hypervisor layer.
• Kernel branch coverage: Fixes were applied to 7.3.3, 6.18.62, 6.12.116, 6.6.162, 6.1.192, 5.15.225, and 5.10.274, representing all currently supported stable branches from 5.10 through 7.3.
• Release scope: Each kernel release contains exclusively these Xen fixes with no other changes, minimizing regression risk for administrators applying the updates.

Why it matters

For Linux distributions shipping Xen-based virtualization stacks—including Citrix Hypervisor, Qubes OS, and cloud providers running custom Xen deployments—these kernel updates are critical infrastructure patches requiring prompt deployment. The narrow scope of each release reduces testing burden, but the privilege escalation potential in CVE-2026-100081 means multi-tenant environments face elevated risk until patched. Long-term support branches 5.10 and 5.15 receiving fixes also protects embedded and enterprise systems with extended maintenance contracts that cannot migrate to newer kernels.