CVE-2026-100081

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: defer xenvif mcast addr list free()

In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif start xmit(), while adds/removes happen from xenvif tx action() (called out of xenvif poll()).

Move the call out of xenvif disconnect data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend disconnect().

This is XSA-527 / CVE-2026-100081.