CVE-2026-100082

In the Linux kernel, the following vulnerability has been resolved:

xen-blkback: Avoid UAF when reading I/O statistics

Reading I/O statistics via sysfs concurrently with tearing down a
frontend device might result in UAF or a NULL dereference, as the
reading of the statistics data is not synchronized with freeing the
data.

Use a rwlock for synchronizing.

This is XSA-528 / CVE-2026-100082