xen-blkback: Avoid UAF when reading I/O statistics

Reading I/O statistics via sysfs concurrently with tearing down a
frontend device might result in UAF or a NULL dereference, as the
reading of the statistics data is not synchronized with freeing the
data.

Use a rwlock for synchronizing.

This is XSA-528 / CVE-2026-100082

Fixes: db6fbc106786 ("xen/blkback: make st_ statistics per ring")
Reported-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Roger Pau Monné <roger@xenproject.org>

0 files changed, 0 insertions, 0 deletions