Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
174 vulnerabilities
CVE-2026-102700 (GCVE-0-2026-102700)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:45 – Updated: 2026-10-13 16:11
VLAI
EPSS
VEX
Title
gnttab: cache-flush handling may cause page reference leak
Summary
With its original introduction, GNTTAB_cache_flush was made available
uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL
pointer check, yet the addition of that check failed to adjust the
subsequent error path. That error path fails to drop a page reference in
case the specified page is owned by a special system domain (DOM_IO and
DOM_COW are system domains which can have memory pages assigned to them.)
Severity
No CVSS data available.
Assigner
References
Date Public
2026-10-13 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-13T16:11:54.099Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-520.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-520"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Xen versions 4.5 through 4.20 are affected. Xen versions 4.21 and\nnewer as well as 4.4 and older are not affected.\n\nOnly x86 systems are vulnerable. Arm systems are not vulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered independently by Andrew Cooper of Citrix and\nYehyeong Lee."
}
],
"datePublic": "2026-10-13T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "With its original introduction, GNTTAB_cache_flush was made available\nuniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL\npointer check, yet the addition of that check failed to adjust the\nsubsequent error path. That error path fails to drop a page reference in\ncase the specified page is owned by a special system domain (DOM_IO and\nDOM_COW are system domains which can have memory pages assigned to them.)"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "The most likely outcome is Denial of Service (DoS) of either Domain 0\n(then likely affecting the entire host) or of another domain."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:45:27.794Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-520.html"
}
],
"title": "gnttab: cache-flush handling may cause page reference leak",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-102700",
"datePublished": "2026-10-13T15:45:27.794Z",
"dateReserved": "2026-09-29T16:11:40.973Z",
"dateUpdated": "2026-10-13T16:11:54.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102702 (GCVE-0-2026-102702)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:45 – Updated: 2026-10-13 15:45
VLAI
EPSS
VEX
Title
Arm: multiple issues with GNTTABOP_cache_flush
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
calculations involved in guests flushing caches through
GNTTABOP_cache_flush. Unfortunately the fix there introduced a
calculation which may underflow, resulting in a loop which would - at
least on 64-bit Arm - take excessively long, and which would likely
eventually crash the hypervisor.
This is CVE-2026-102699.
2) GNTTABOP_cache_flush may be issued on memory mapped from another
domain using the grant table interface. However there was no
restriction to disallow the use of invalidate-without-clean against
read-only grant mappings, which may corrupt the granted memory.
This is CVE-2026-102702.
Severity
No CVSS data available.
Assigner
References
1 reference
Date Public
2026-10-13 12:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-519"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable.\n\nOnly Arm systems are vulnerable. x86 systems are not vulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CVE-2026-102699 was discovered by Leonid Komarianskyi of EPAM. It was\nlater independently reported by Ayan Kumar Halder of AMD.\n\nCVE-2026-102702 was found by the security team while looking at the\nsurrounding code."
}
],
"datePublic": "2026-10-13T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n calculations involved in guests flushing caches through\n GNTTABOP_cache_flush. Unfortunately the fix there introduced a\n calculation which may underflow, resulting in a loop which would - at\n least on 64-bit Arm - take excessively long, and which would likely\n eventually crash the hypervisor.\n\n This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n domain using the grant table interface. However there was no\n restriction to disallow the use of invalidate-without-clean against\n read-only grant mappings, which may corrupt the granted memory.\n\n This is CVE-2026-102702."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious unprivileged guest may crash the hypervisor, causing a\nDenial of Service (DoS) affecting the entire host, or corrupt memory\nbelonging to another domain. Privilege escalation and information leaks\ncannot be ruled out."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:45:13.125Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-519.html"
}
],
"title": "Arm: multiple issues with GNTTABOP_cache_flush",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-102702",
"datePublished": "2026-10-13T15:45:13.125Z",
"dateReserved": "2026-09-29T16:11:40.973Z",
"dateUpdated": "2026-10-13T15:45:13.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102699 (GCVE-0-2026-102699)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:45 – Updated: 2026-10-13 15:45
VLAI
EPSS
VEX
Title
Arm: multiple issues with GNTTABOP_cache_flush
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
calculations involved in guests flushing caches through
GNTTABOP_cache_flush. Unfortunately the fix there introduced a
calculation which may underflow, resulting in a loop which would - at
least on 64-bit Arm - take excessively long, and which would likely
eventually crash the hypervisor.
This is CVE-2026-102699.
2) GNTTABOP_cache_flush may be issued on memory mapped from another
domain using the grant table interface. However there was no
restriction to disallow the use of invalidate-without-clean against
read-only grant mappings, which may corrupt the granted memory.
This is CVE-2026-102702.
Severity
No CVSS data available.
Assigner
References
1 reference
Date Public
2026-10-13 12:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-519"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable.\n\nOnly Arm systems are vulnerable. x86 systems are not vulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CVE-2026-102699 was discovered by Leonid Komarianskyi of EPAM. It was\nlater independently reported by Ayan Kumar Halder of AMD.\n\nCVE-2026-102702 was found by the security team while looking at the\nsurrounding code."
}
],
"datePublic": "2026-10-13T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n calculations involved in guests flushing caches through\n GNTTABOP_cache_flush. Unfortunately the fix there introduced a\n calculation which may underflow, resulting in a loop which would - at\n least on 64-bit Arm - take excessively long, and which would likely\n eventually crash the hypervisor.\n\n This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n domain using the grant table interface. However there was no\n restriction to disallow the use of invalidate-without-clean against\n read-only grant mappings, which may corrupt the granted memory.\n\n This is CVE-2026-102702."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious unprivileged guest may crash the hypervisor, causing a\nDenial of Service (DoS) affecting the entire host, or corrupt memory\nbelonging to another domain. Privilege escalation and information leaks\ncannot be ruled out."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:45:13.073Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-519.html"
}
],
"title": "Arm: multiple issues with GNTTABOP_cache_flush",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-102699",
"datePublished": "2026-10-13T15:45:13.073Z",
"dateReserved": "2026-09-29T16:11:40.973Z",
"dateUpdated": "2026-10-13T15:45:13.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79611 (GCVE-0-2026-79611)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:44 – Updated: 2026-10-13 16:13
VLAI
EPSS
VEX
Title
VMX: VMentry failure with branch tracing and blocked states
Summary
For XSA-308 logic was introduced, as VMX VMEntry checks do not like the
exact combination of state which occurs when #DB in intercepted, Single
Stepping is active, and blocked by STI/MovSS is active, despite this being
a legitimate state to be in. The resulting VMEntry failure is fatal to
the guest.
Sadly there is another special sub-case of the above, with branch tracing
enabled. In that case the prior adjustment would still cause a VMentry
failure, as before fatal to the guest.
Severity
No CVSS data available.
Assigner
References
Date Public
2026-10-13 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-13T16:13:51.786Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-518.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/13/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-518"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All versions of Xen are affected.\n\nOnly systems supporting VMX hardware virtual extensions (Intel, VIA or\nZhaoxin CPUs) are affected. Arm as well as AMD and Hygon systems are\nunaffected.\n\nOnly HVM/PVH guests are affected. PV guests cannot leverage the\nvulnerability."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Claude Opus and diagnosed as a security issue\nby Teddy Astie of Vates."
}
],
"datePublic": "2026-10-13T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "For XSA-308 logic was introduced, as VMX VMEntry checks do not like the\nexact combination of state which occurs when #DB in intercepted, Single\nStepping is active, and blocked by STI/MovSS is active, despite this being\na legitimate state to be in. The resulting VMEntry failure is fatal to\nthe guest.\n\nSadly there is another special sub-case of the above, with branch tracing\nenabled. In that case the prior adjustment would still cause a VMentry\nfailure, as before fatal to the guest."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "HVM/PVH guest userspace code may be able to crash the guest, resulting\nin a guest Denial of Service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:44:56.361Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-518.html"
}
],
"title": "VMX: VMentry failure with branch tracing and blocked states",
"workarounds": [
{
"lang": "en",
"value": "Running only PV guests will avoid this vulnerability.\n\nRunning HVM guests on only AMD or Hygon hardware will also avoid this\nvulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-79611",
"datePublished": "2026-10-13T15:44:56.361Z",
"dateReserved": "2026-08-25T07:35:05.290Z",
"dateUpdated": "2026-10-13T16:13:51.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79610 (GCVE-0-2026-79610)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:44 – Updated: 2026-10-13 16:13
VLAI
EPSS
VEX
Title
grant-table: double version change race
Summary
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other grant table operations. Sadly a v2 -> v1 -> v2 change has yet
another effect which wasn't accounted for: During the first change, status
pages would be freed. During the second change they would be allocated
again. Hence across the full pair of change the addresses of the status
pages may change, rendering stale previously calculated pointers into the
status array.
Severity
No CVSS data available.
Assigner
References
Date Public
2026-10-13 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-13T16:13:47.749Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-517.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/13/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-517"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and\nearlier are not vulnerable.\n\nOnly x86 guests permitted to use grant table version 2 interfaces can\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported.\n\nOnly multi-vCPU guests can leverage this vulnerability.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Claude Opus and diagnosed as a security issue\nby Teddy Astie of Vates."
}
],
"datePublic": "2026-10-13T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "XSA-501 was about issues with v1 -\u003e v2 and v2 -\u003e v1 changes racing certain\nother grant table operations. Sadly a v2 -\u003e v1 -\u003e v2 change has yet\nanother effect which wasn\u0027t accounted for: During the first change, status\npages would be freed. During the second change they would be allocated\nagain. Hence across the full pair of change the addresses of the status\npages may change, rendering stale previously calculated pointers into the\nstatus array."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:44:42.370Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-517.html"
}
],
"title": "grant-table: double version change race",
"workarounds": [
{
"lang": "en",
"value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for guests will\nalso avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-79610",
"datePublished": "2026-10-13T15:44:42.370Z",
"dateReserved": "2026-08-25T07:35:05.290Z",
"dateUpdated": "2026-10-13T16:13:47.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79609 (GCVE-0-2026-79609)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:44 – Updated: 2026-10-13 16:13
VLAI
EPSS
VEX
Title
x86: XPTI may break on huge-memory systems
Summary
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV
guest page table entries from guest-chosen root page tables to the Xen-
chosen one which is in actual use by hardware. To read the guest root
page table, the directmap is used. PV guests, however, have a directmap
which may not cover all memory; in particular this is the case if any
memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address
boundary.
Severity
No CVSS data available.
Assigner
References
Date Public
2026-10-13 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-13T16:13:43.715Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-516.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-516"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All versions of Xen with the XPTI work backported to are affected. In\nupstream these are Xen 4.7.5 and onwards, Xen 4.8.3 and onwards, Xen 4.9.2\nand onwards, Xen 4.10.1 and onwards, and all major releases from 4.11\nonwards.\n\nOnly 64-bit PV guests can leverage the vulnerability. HVM and PVH guests\ncannot leverage the vulnerability. 32-bit PV guests haven\u0027t been security\nsupported anymore.\n\nOnly x86 systems are affected. Arm systems are not affected.\n\nOnly systems with RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) boundary\nare affected. Systems with no RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5\nTiB) boundary are not affected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by George Dunlap."
}
],
"datePublic": "2026-10-13T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown\n(CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV\nguest page table entries from guest-chosen root page tables to the Xen-\nchosen one which is in actual use by hardware. To read the guest root\npage table, the directmap is used. PV guests, however, have a directmap\nwhich may not cover all memory; in particular this is the case if any\nmemory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address\nboundary."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A 64-bit PV guest may be able to elevate its privilege to that of the\nhost. It is also possible for them to observe information pertaining to\nother guests, or to cause Denial of Service (DoS) affecting the entire\nhost."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:44:24.763Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-516.html"
}
],
"title": "x86: XPTI may break on huge-memory systems",
"workarounds": [
{
"lang": "en",
"value": "Not running 64-bit PV guests will avoid the vulnerability.\n\nThe \"mem=\" hypervisor command line option may be used to limit the amount\nof memory Xen is going to use. That would be \"mem=5T\" for the\nCONFIG_BIGMEM=n case and \"mem=3584G\" for the CONFIG_BIGMEM=y one."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-79609",
"datePublished": "2026-10-13T15:44:24.763Z",
"dateReserved": "2026-08-25T07:35:05.289Z",
"dateUpdated": "2026-10-13T16:13:43.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79608 (GCVE-0-2026-79608)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:44 – Updated: 2026-10-13 16:13
VLAI
EPSS
VEX
Title
x86/AMD: ineffectual Zenbleed workaround
Summary
The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to better integrate with other manipulations of the same MSR.
In this rework an inverted conditional was introduced, resulting in the
workaround to not be applied when needed and vice versa.
For more details, see:
http://xenbits.xen.org/xsa/advisory-433.html
Severity
No CVSS data available.
Assigner
References
Date Public
2026-10-13 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-13T16:13:41.507Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-515.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-515"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Xen versions 4.19.4 and onwards, 4.20.3 and onwards, 4.21.1 and onwards,\nand 4.22 are affected. Xen versions 4.18, minor versions 4.19.3 and\nearlier, minor versions 4.20.2 and earlier, and 4.21.0 are not affected.\n\nThe vulnerability can only be leveraged on systems running out-of-date\nmicrocode. Microcode fixing Zenbleed was published in late 2023.\nUpdated firmware subseqeuent to this, or e.g. updated amd-ucode from\nlinux-firmware (for the subset of CPUs covered by linux-firmware) are\nnot vulnerable.\n\nThe original issue and hence the applicability of the workaround is\nspecific to the AMD Zen2 microarchitecture. AMD do not believe that\nother microarchitectures are affected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Sashiko + Opus 5.0 and diagnosed as a\nsecurity issue by George Dunlap."
}
],
"datePublic": "2026-10-13T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate with other manipulations of the same MSR.\nIn this rework an inverted conditional was introduced, resulting in the\nworkaround to not be applied when needed and vice versa.\n\nFor more details, see:\n http://xenbits.xen.org/xsa/advisory-433.html"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can exploit this bug to read data from different contexts on\nthe same core. Examples of such data includes key material, cypher and\nplaintext from the AES-NI instructions, or the contents of REP-MOVS\ninstructions, commonly used to implement memcpy()."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:44:08.729Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-515.html"
}
],
"title": "x86/AMD: ineffectual Zenbleed workaround",
"workarounds": [
{
"lang": "en",
"value": "This issue can be mitigated by disabling AVX, either by booting Xen with\n`cpuid=no-avx` on the command line, or by specifying `cpuid=\"host:avx=0\"` in\nthe vm.cfg file of all untrusted VMs. However, this will come with a\nsignificant impact on the system and is not recommended for anyone able to\ndeploy the microcode or patch described below."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-79608",
"datePublished": "2026-10-13T15:44:08.729Z",
"dateReserved": "2026-08-25T07:35:05.289Z",
"dateUpdated": "2026-10-13T16:13:41.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79607 (GCVE-0-2026-79607)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:43 – Updated: 2026-10-13 16:13
VLAI
EPSS
VEX
Title
Xenstore: Guests can crash xenstored during Live Update
Summary
During Xenstore live update the state record for a Xenstore watch with
specified watch depth is written with two bytes missing. This results
in an inconsistent state when reading the state back in the new Xenstore,
causing a crash of Xenstore or wrong Xenstore data.
Severity
No CVSS data available.
Assigner
References
Date Public
2026-10-13 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-13T16:13:38.746Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-514.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/13/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-514"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Only systems running Xen 4.22 are vulnerable. Systems running Xen 4.21\nor older are not vulnerable.\n\nOnly systems running C xenstore either as daemon or as stubdom are\nvulnerable. Systems running oxenstored are not vulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Andrii Sultanov of Vates."
}
],
"datePublic": "2026-10-13T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "During Xenstore live update the state record for a Xenstore watch with\nspecified watch depth is written with two bytes missing. This results\nin an inconsistent state when reading the state back in the new Xenstore,\ncausing a crash of Xenstore or wrong Xenstore data."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest can cause the Xenstore service to crash or to get\ncorrupted during a live update of Xenstore, causing a DoS of the host\nregarding further domain administration actions."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:43:43.425Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-514.html"
}
],
"title": "Xenstore: Guests can crash xenstored during Live Update",
"workarounds": [
{
"lang": "en",
"value": "Not doing a live update of Xenstore avoids the vulnerability.\n\nSwitching to oxenstored avoids the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-79607",
"datePublished": "2026-10-13T15:43:43.425Z",
"dateReserved": "2026-08-25T07:35:05.289Z",
"dateUpdated": "2026-10-13T16:13:38.746Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79603 (GCVE-0-2026-79603)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:11 – Updated: 2026-09-08 17:08
VLAI
EPSS
VEX
Title
Unconditionally do TLB flushing ahead of page scrubbing
Summary
x86 PV guests can free memory pages while still keeping a stale TLB entry
pointing to them. A TLB flush is only issued by Xen (if needed) when the
page is re-used. Since it's possible for the page to be scrubbed ahead of
the TLB flush, there's a window where a PV guest can modify an already
scrubbed page.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:42 UTC
CWE
- CWE-664 - Improper Control of a Resource Through its Lifetime
Assigner
References
Date Public
2026-09-08 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-08T17:08:33.807Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-511.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/08/8"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-79603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:42:37.092287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-664",
"description": "CWE-664 Improper Control of a Resource Through its Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:42:41.424Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-511"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.13 onwards are vulnerable. Xen versions 4.12 and\nearlier are not vulnerable as they lack the `scrub-domheap` command line\noption.\n\nOnly x86 PV guests can exploit the vulnerability."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Roger Pau Monn\u00e9 of AMD."
}
],
"datePublic": "2026-09-08T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "x86 PV guests can free memory pages while still keeping a stale TLB entry\npointing to them. A TLB flush is only issued by Xen (if needed) when the\npage is re-used. Since it\u0027s possible for the page to be scrubbed ahead of\nthe TLB flush, there\u0027s a window where a PV guest can modify an already\nscrubbed page."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Deployments using `xsm=silo scrub-domheap` with the aim of not allowing the\nexchange of information amongst guests are not effective in the presence of\nPV guests."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:11:21.789Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-511.html"
}
],
"title": "Unconditionally do TLB flushing ahead of page scrubbing",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-79603",
"datePublished": "2026-09-08T12:11:21.789Z",
"dateReserved": "2026-08-25T07:35:05.289Z",
"dateUpdated": "2026-09-08T17:08:33.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79602 (GCVE-0-2026-79602)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:11 – Updated: 2026-09-10 18:08
VLAI
EPSS
VEX
Title
x86: improper handling of HVM emulation return codes
Summary
A guest with a PCI device assigned that has at least a BAR on the IO port
space can trigger a BUG() in Xen.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 18:08 UTC
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
Date Public
2026-09-08 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-08T17:08:32.715Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-510.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/08/7"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-79602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T18:08:16.213605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:08:59.554Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-510"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Xen versions 4.6 and later are vulnerable. This is known to be the case\nwith the fix for XSA-491, but it\u0027s possible the issue can also be\ntriggered from other, non-analyzed paths.\n\nOnly x86 systems are vulnerable. Arm systems are not vulnerable.\n\nOnly HVM guests with a PCI device with IO BARs assigned can leverage the\nvulnerability."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Jiqian Chen of AMD and diagnosed as a\nsecurity issue by Roger Pau Monn\u00e9 of AMD."
}
],
"datePublic": "2026-09-08T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A guest with a PCI device assigned that has at least a BAR on the IO port\nspace can trigger a BUG() in Xen."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Passing through a PCI device with at least one BAR in IO address space to\nunprivileged HVM guests can result in a Denial of Service (DoS) affecting\nthe entire host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:11:08.534Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-510.html"
}
],
"title": "x86: improper handling of HVM emulation return codes",
"workarounds": [
{
"lang": "en",
"value": "There is no mitigation available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-79602",
"datePublished": "2026-09-08T12:11:08.534Z",
"dateReserved": "2026-08-25T07:35:05.289Z",
"dateUpdated": "2026-09-10T18:08:59.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62437 (GCVE-0-2026-62437)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:10 – Updated: 2026-09-10 18:13
VLAI
EPSS
VEX
Title
x86: DMs may cause mem leak by IRQ binding
Summary
When guests are terminated, various pieces of cleanup need carrying out.
The cleaning up of PCI devices which were assigned to guests, and the
associated removal of tracking structures for IRQs used by the devices
occurs relatively early in the process. Unfortunately after that point
the guest about to be terminated could cause its device model (DM) to
re-establish such tracking structures, by having it bind one or more IRQs
anew. While some of those tracking structures would still be cleaned up
later on, at least one would not be.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 18:11 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-09-08 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-08T17:08:26.757Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-509.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/08/6"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62437",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T18:11:30.445915Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:13:23.073Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-509"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected.\n\nOnly HVM guests with assigned PCI devices can leverage the vulnerability."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Jan Beulich of SUSE."
}
],
"datePublic": "2026-09-08T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process. Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew. While some of those tracking structures would still be cleaned up\nlater on, at least one would not be."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A HVM guest with one or more PCI devices assigned can cause a memory leak\nin the hypervisor, possibly leading to Denial of Service (DoS) of the\nentire host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:10:52.643Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-509.html"
}
],
"title": "x86: DMs may cause mem leak by IRQ binding",
"workarounds": [
{
"lang": "en",
"value": "Running only PV or PVH guests will avoid the vulnerability.\n\nRunning only HVM guests without passing through PCI devices to them will\nalso avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62437",
"datePublished": "2026-09-08T12:10:52.643Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-09-10T18:13:23.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62434 (GCVE-0-2026-62434)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:33 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
PoD: Don't try to reclaim special pages
Summary
A guest started with Populated on Demand enabled (PoD) can attempt to
reclaim pages which aren't regular guest RAM. This can cause corruption
of memory management state in Xen.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:59 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:34.668Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-507.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/23"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:59:52.970334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:00:00.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-507"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and\nearlier are not vulnerable.\n\nOnly x86 systems are vulnerable.\n\nOnly x86 HVM and PVH guests started in populate-on-demand mode are\nbelieved to be able to leverage the vulnerability. Populate-on-demand\nmode is activated when the guest\u0027s xl configuration file specifies a\n\"maxmem\" value which is larger than the \"memory\" value."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A guest started with Populated on Demand enabled (PoD) can attempt to\nreclaim pages which aren\u0027t regular guest RAM. This can cause corruption\nof memory management state in Xen."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A buggy or malicious guest can cause corruption of Xen\u0027s state, leading\nto crashes or other malfunctions. Information leak and privilege\nescalation cannot be ruled out."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:33:08.540Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-507.html"
}
],
"title": "PoD: Don\u0027t try to reclaim special pages",
"workarounds": [
{
"lang": "en",
"value": "Running only PV guests or HVM/PVH guests without PoD will avoid the\nvulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62434",
"datePublished": "2026-07-28T12:33:08.540Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:34.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62433 (GCVE-0-2026-62433)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
correct buffer checks for DM_OP hypercalls
Summary
Parts of the DM_OP handling code assumes the caller has provided the
required number of buffers for the given operation without any checking
being done. As a result, certain operations might access stack
rubble as structures are possibly uninitialized.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:03 UTC
CWE
- CWE-665 - Improper Initialization
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:33.573Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-506.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/22"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62433",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:03:57.527525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:06:29.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-506"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.10 onwards are vulnerable. Xen versions 4.9 and\nearlier are not vulnerable.\n\nOnly entities controlling HVM guests can leverage the vulnerability.\nThese are device models running in either a stub domain or de-privileged\nin Dom0."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Parts of the DM_OP handling code assumes the caller has provided the\nrequired number of buffers for the given operation without any checking\nbeing done. As a result, certain operations might access stack\nrubble as structures are possibly uninitialized."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A device model of a HVM guest can gain insight on the contents of the\nXen stack, thus possibly leaking data from other guests contexts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:59.802Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-506.html"
}
],
"title": "correct buffer checks for DM_OP hypercalls",
"workarounds": [
{
"lang": "en",
"value": "Running only PV or PVH guests will avoid the vulnerability.\n\n(Switching from a device model stub domain or a de-privileged device\nmodel to a fully privileged Dom0 device model does NOT mitigate this\nvulnerability. Rather, it simply recategorises the vulnerability to\nhostile management code, regarding it \"as designed\"; thus it merely\nreclassifies these issues as \"not a bug\". The security of a Xen system\nusing stub domains is still better than with a qemu-dm running as a Dom0\nprocess. Users and vendors of stub qemu dm systems should not change\ntheir configuration to use a Dom0 QEMU process.)"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62433",
"datePublished": "2026-07-28T12:32:59.802Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:33.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62432 (GCVE-0-2026-62432)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
evtchn: Race between FIFO expand and reset
Summary
The EVTCHNOP_expand_array hypercall checks for whether FIFO event
channels are enabled, but without holding the correct lock. It can race
with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:13 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:32.509Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-505.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/21"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:13:34.638706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:13:39.575Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-505"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The EVTCHNOP_expand_array hypercall checks for whether FIFO event\nchannels are enabled, but without holding the correct lock. It can race\nwith EVTCHNOP_reset, resulting in dereferencing a NULL pointer."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious HVM guest (x86 HVM or PVH, and ARM) can crash Xen leading to\na denial of service.\n\nA malicious x86 PV guest can most likely crash Xen leading to a denial\nof service, but memory corruption or privilege escalation cannot be\nruled out."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:52.043Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-505.html"
}
],
"title": "evtchn: Race between FIFO expand and reset",
"workarounds": [
{
"lang": "en",
"value": "There are no mitigations."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62432",
"datePublished": "2026-07-28T12:32:52.043Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:32.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62431 (GCVE-0-2026-62431)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
Viridian STIMER division by zero
Summary
The logic to handle periodic Viridian STIMERs performs a division with an
unchecked user-controlled divisor value, that can be set to zero to cause a #DE
fault.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:49 UTC
CWE
- CWE-369 - Divide By Zero
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:31.447Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-504.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/20"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:49:03.810668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-369",
"description": "CWE-369 Divide By Zero",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:49:09.743Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-504"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.13 onwards are vulnerable. Xen versions 4.12 and\nearlier are not vulnerable.\n\nOnly HVM guests with Viridian STIMERs enabled can trigger the vulnerability."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The logic to handle periodic Viridian STIMERs performs a division with an\nunchecked user-controlled divisor value, that can be set to zero to cause a #DE\nfault."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Enabling Viridian STIMERs to unprivileged HVM guests can result in a Denial\nof Service (DoS) affecting the entire host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:43.849Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-504.html"
}
],
"title": "Viridian STIMER division by zero",
"workarounds": [
{
"lang": "en",
"value": "Not enabling Viridian STIMERs for HVM guests will avoid the vulnerability.\n\nNote Viridian extensions are not enabled by default."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62431",
"datePublished": "2026-07-28T12:32:43.849Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:31.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62430 (GCVE-0-2026-62430)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
x86: Out-of-bounds read in vRTC emulation
Summary
Accesses to the CMOS memory contents are done using an indirect IO port
pair. Therefore Xen needs to cache the guest chosen index, and one of
the usages of the index didn't take the necessary locking to avoid
concurrent changes. As a result, a guest could change the index after
it being checked, causing a subsequent out-of-bound read access to the
contents of an array.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:50 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:30.367Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-503.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/19"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62430",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:50:31.706627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:50:36.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-503"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 3.2 onwards are vulnerable. Xen versions 3.1 and\nearlier are not vulnerable."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Accesses to the CMOS memory contents are done using an indirect IO port\npair. Therefore Xen needs to cache the guest chosen index, and one of\nthe usages of the index didn\u0027t take the necessary locking to avoid\nconcurrent changes. As a result, a guest could change the index after\nit being checked, causing a subsequent out-of-bound read access to the\ncontents of an array."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can read out-of-bounds, this is limited to Xen data, and not\ndata belonging to other guests."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:33.150Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-503.html"
}
],
"title": "x86: Out-of-bounds read in vRTC emulation",
"workarounds": [
{
"lang": "en",
"value": "Running only PV or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62430",
"datePublished": "2026-07-28T12:32:33.150Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:30.367Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62429 (GCVE-0-2026-62429)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
vNUMA domain cleanup may race other operations
Summary
Accessing the vNUMA configuration data of a guest is still possible when
domain destruction has already started. The cleaning up of that
configuration information is not synchronized with its retrieval by a
device model controlling the guest.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:56 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:29.286Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-502.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62429",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:56:13.716116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:51:45.362Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-502"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable.\n\nOnly entities controlling guests (on x86: HVM guests) can leverage the\nvulnerability. These are device models running in either a stub domain or\nde-privileged in Dom0.\n\nOnly guests which have vNUMA enabled allow their controlling entities to\nleverage the vulnerability."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Teddy Astie of Vates."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Accessing the vNUMA configuration data of a guest is still possible when\ndomain destruction has already started. The cleaning up of that\nconfiguration information is not synchronized with its retrieval by a\ndevice model controlling the guest."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "While Denial of Service (DoS) affecting the entire host and information\nleaks and are the prevailing effect, a device model stub domain or a\nde-privileged device model running in the control domain may also be\nable to elevate its privileges to that of the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:24.333Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-502.html"
}
],
"title": "vNUMA domain cleanup may race other operations",
"workarounds": [
{
"lang": "en",
"value": "On x86, running only PV or PVH guests will avoid the vulnerability.\n\nNot enabling vNUMA for HVM guests will also avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62429",
"datePublished": "2026-07-28T12:32:24.333Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:29.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62436 (GCVE-0-2026-62436)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 15:17
VLAI
EPSS
VEX
Title
grant-table: version change racing with other operations
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Grant Table v2 came the requirement to be able to
switch between versions. Switching from v1 to v2 reduces the number of
valid grant references, as a bigger shared entry structure is then needed
while the shared table doesn't change size. Switching from v2 back to v1
the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant
table lock, sometimes wrongly assumes that said properties wouldn't change
across the window in time where the lock is not being held.
The v1 -> v2 issue is CVE-2026-62435.
The v2 -> v1 issue is CVE-2026-62436.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:16 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:16:28.153900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:17:33.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-501"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and\nearlier are not vulnerable.\n\nOnly x86 guests permitted to use grant table version 2 interfaces can\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported.\n\nOnly multi-vCPU guests can leverage this vulnerability.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Mark Esler."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nWith the introduction of Grant Table v2 came the requirement to be able to\nswitch between versions. Switching from v1 to v2 reduces the number of\nvalid grant references, as a bigger shared entry structure is then needed\nwhile the shared table doesn\u0027t change size. Switching from v2 back to v1\nthe status frames, which are separate in v2, go away.\n\nCode holding, but intermediately dropping and then re-acquiring the grant\ntable lock, sometimes wrongly assumes that said properties wouldn\u0027t change\nacross the window in time where the lock is not being held.\n\nThe v1 -\u003e v2 issue is CVE-2026-62435.\n\nThe v2 -\u003e v1 issue is CVE-2026-62436."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:16.344Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-501.html"
}
],
"title": "grant-table: version change racing with other operations",
"workarounds": [
{
"lang": "en",
"value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for guests will\nalso avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62436",
"datePublished": "2026-07-28T12:32:16.344Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:17:33.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62435 (GCVE-0-2026-62435)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 15:19
VLAI
EPSS
VEX
Title
grant-table: version change racing with other operations
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Grant Table v2 came the requirement to be able to
switch between versions. Switching from v1 to v2 reduces the number of
valid grant references, as a bigger shared entry structure is then needed
while the shared table doesn't change size. Switching from v2 back to v1
the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant
table lock, sometimes wrongly assumes that said properties wouldn't change
across the window in time where the lock is not being held.
The v1 -> v2 issue is CVE-2026-62435.
The v2 -> v1 issue is CVE-2026-62436.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:19 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:19:26.810813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:19:30.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-501"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and\nearlier are not vulnerable.\n\nOnly x86 guests permitted to use grant table version 2 interfaces can\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported.\n\nOnly multi-vCPU guests can leverage this vulnerability.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Mark Esler."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nWith the introduction of Grant Table v2 came the requirement to be able to\nswitch between versions. Switching from v1 to v2 reduces the number of\nvalid grant references, as a bigger shared entry structure is then needed\nwhile the shared table doesn\u0027t change size. Switching from v2 back to v1\nthe status frames, which are separate in v2, go away.\n\nCode holding, but intermediately dropping and then re-acquiring the grant\ntable lock, sometimes wrongly assumes that said properties wouldn\u0027t change\nacross the window in time where the lock is not being held.\n\nThe v1 -\u003e v2 issue is CVE-2026-62435.\n\nThe v2 -\u003e v1 issue is CVE-2026-62436."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:16.287Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-501.html"
}
],
"title": "grant-table: version change racing with other operations",
"workarounds": [
{
"lang": "en",
"value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for guests will\nalso avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62435",
"datePublished": "2026-07-28T12:32:16.287Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:19:30.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62428 (GCVE-0-2026-62428)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
grant-table: type confusion in grant-copy
Summary
When grant-copy operations are processed, the respective grant may or may
not already be in use by another operation (a mapping or another copy).
For all copy operations the referenced guest frame is looked up. When
another operation is already active for the grant (the grant is "pinned"),
what is being supplied back to actually carry out permission checks and
copy operation may not be consistent: The permission check may be carried
out on a page different from the one involved in the copy.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:10 UTC
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:28.183Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-500.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/16"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62428",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:10:28.542416Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:10:53.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-500"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.2 onwards are vulnerable. Xen versions 4.1 and\nearlier are not vulnerable.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Roman S."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When grant-copy operations are processed, the respective grant may or may\nnot already be in use by another operation (a mapping or another copy).\nFor all copy operations the referenced guest frame is looked up. When\nanother operation is already active for the grant (the grant is \"pinned\"),\nwhat is being supplied back to actually carry out permission checks and\ncopy operation may not be consistent: The permission check may be carried\nout on a page different from the one involved in the copy."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:07.573Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-500.html"
}
],
"title": "grant-table: type confusion in grant-copy",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62428",
"datePublished": "2026-07-28T12:32:07.573Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:28.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62427 (GCVE-0-2026-62427)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:54
VLAI
EPSS
VEX
Title
sysctl and platform-op locks open to abuse
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
To manage the system, sysctl and platform operations are used by the
control domain or a possible Xenstore domain. Some of these operations
may not be executed in parallel, so a system-wide lock each is used.
The way those locks are acquired is, however, not providing any fairness.
Furthermore, with XSM/Flask in use, the lock acquire will, for some
operations, occur ahead of any permission checking.
The sysctl issue is CVE-2026-62426.
The platform-op issue is CVE-2026-62427.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:54 UTC
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62427",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:54:13.421567Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:54:19.508Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-499"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Earlier versions use\na different locking operation, but may also be vulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Jan Beulich of SUSE."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo manage the system, sysctl and platform operations are used by the\ncontrol domain or a possible Xenstore domain. Some of these operations\nmay not be executed in parallel, so a system-wide lock each is used.\nThe way those locks are acquired is, however, not providing any fairness.\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.\n\nThe sysctl issue is CVE-2026-62426.\n\nThe platform-op issue is CVE-2026-62427."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A less privileged entity may stall an equally or more privileged entity,\npotentially leading to a Denial od Service (DoS) of up to the entire\nhost."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:57.645Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-499.html"
}
],
"title": "sysctl and platform-op locks open to abuse",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62427",
"datePublished": "2026-07-28T12:31:57.645Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:54:19.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62426 (GCVE-0-2026-62426)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:55
VLAI
EPSS
VEX
Title
sysctl and platform-op locks open to abuse
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
To manage the system, sysctl and platform operations are used by the
control domain or a possible Xenstore domain. Some of these operations
may not be executed in parallel, so a system-wide lock each is used.
The way those locks are acquired is, however, not providing any fairness.
Furthermore, with XSM/Flask in use, the lock acquire will, for some
operations, occur ahead of any permission checking.
The sysctl issue is CVE-2026-62426.
The platform-op issue is CVE-2026-62427.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:55 UTC
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:55:06.523957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-667",
"description": "CWE-667 Improper Locking",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-412",
"description": "CWE-412 Unrestricted Externally Accessible Lock",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:55:11.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-499"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Earlier versions use\na different locking operation, but may also be vulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Jan Beulich of SUSE."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo manage the system, sysctl and platform operations are used by the\ncontrol domain or a possible Xenstore domain. Some of these operations\nmay not be executed in parallel, so a system-wide lock each is used.\nThe way those locks are acquired is, however, not providing any fairness.\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.\n\nThe sysctl issue is CVE-2026-62426.\n\nThe platform-op issue is CVE-2026-62427."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A less privileged entity may stall an equally or more privileged entity,\npotentially leading to a Denial od Service (DoS) of up to the entire\nhost."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:57.586Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-499.html"
}
],
"title": "sysctl and platform-op locks open to abuse",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62426",
"datePublished": "2026-07-28T12:31:57.586Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:55:11.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62425 (GCVE-0-2026-62425)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:40
VLAI
EPSS
VEX
Title
buffer overruns in libfsimage iso9660 handling
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:40 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62425",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:40:12.638109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:40:37.904Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-497"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length. This is\n CVE-2026-42494.\n\n * The calculation of the System Use area may underflow. This is\n CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n This is CVE-2026-62425."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:41.918Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
}
],
"title": "buffer overruns in libfsimage iso9660 handling",
"workarounds": [
{
"lang": "en",
"value": "XSA-443 added a mechanism to run pygrub de-privileged. Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62425",
"datePublished": "2026-07-28T12:31:41.918Z",
"dateReserved": "2026-07-14T10:28:12.654Z",
"dateUpdated": "2026-07-28T15:40:37.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62424 (GCVE-0-2026-62424)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 14:53
VLAI
EPSS
VEX
Title
buffer overruns in libfsimage iso9660 handling
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:53 UTC
CWE
- CWE-130 - Improper Handling of Length Parameter Inconsistency
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62424",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:53:03.759623Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:53:51.529Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-497"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length. This is\n CVE-2026-42494.\n\n * The calculation of the System Use area may underflow. This is\n CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n This is CVE-2026-62425."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:41.862Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
}
],
"title": "buffer overruns in libfsimage iso9660 handling",
"workarounds": [
{
"lang": "en",
"value": "XSA-443 added a mechanism to run pygrub de-privileged. Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62424",
"datePublished": "2026-07-28T12:31:41.862Z",
"dateReserved": "2026-07-14T10:28:12.654Z",
"dateUpdated": "2026-07-28T14:53:51.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62423 (GCVE-0-2026-62423)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 14:51
VLAI
EPSS
VEX
Title
buffer overruns in libfsimage iso9660 handling
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:49 UTC
CWE
- CWE-130 - Improper Handling of Length Parameter Inconsistency
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:49:36.986097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:51:03.684Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-497"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length. This is\n CVE-2026-42494.\n\n * The calculation of the System Use area may underflow. This is\n CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n This is CVE-2026-62425."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:41.801Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
}
],
"title": "buffer overruns in libfsimage iso9660 handling",
"workarounds": [
{
"lang": "en",
"value": "XSA-443 added a mechanism to run pygrub de-privileged. Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62423",
"datePublished": "2026-07-28T12:31:41.801Z",
"dateReserved": "2026-07-14T10:28:12.654Z",
"dateUpdated": "2026-07-28T14:51:03.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42495 (GCVE-0-2026-42495)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:01
VLAI
EPSS
VEX
Title
buffer overruns in libfsimage iso9660 handling
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:00 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42495",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:00:30.511503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:01:03.756Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-497"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length. This is\n CVE-2026-42494.\n\n * The calculation of the System Use area may underflow. This is\n CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n This is CVE-2026-62425."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:41.743Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
}
],
"title": "buffer overruns in libfsimage iso9660 handling",
"workarounds": [
{
"lang": "en",
"value": "XSA-443 added a mechanism to run pygrub de-privileged. Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42495",
"datePublished": "2026-07-28T12:31:41.743Z",
"dateReserved": "2026-04-27T14:20:24.139Z",
"dateUpdated": "2026-07-28T15:01:03.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42494 (GCVE-0-2026-42494)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:04
VLAI
EPSS
VEX
Title
buffer overruns in libfsimage iso9660 handling
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:04 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:04:14.686627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:04:48.405Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-497"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length. This is\n CVE-2026-42494.\n\n * The calculation of the System Use area may underflow. This is\n CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n This is CVE-2026-62425."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:41.682Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
}
],
"title": "buffer overruns in libfsimage iso9660 handling",
"workarounds": [
{
"lang": "en",
"value": "XSA-443 added a mechanism to run pygrub de-privileged. Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42494",
"datePublished": "2026-07-28T12:31:41.682Z",
"dateReserved": "2026-04-27T14:20:24.139Z",
"dateUpdated": "2026-07-28T15:04:48.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42492 (GCVE-0-2026-42492)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
vIRQ event channel binding may break Xenstore
Summary
Xenstore, to have an up-to-date picture of the entire system, wants to
know of domains appearing and disappearing. To make this more robust, a
new XEN_DOMCTL_get_domain_state was introduced. The management of the
bitmap underlying that operation is tied into the binding of the
VIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear
down the bitmap even in cases when it wasn't set up. Unprivileged domains
can trigger that error path.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:56 UTC
CWE
- CWE-459 - Incomplete Cleanup
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:22.683Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-496.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/13"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42492",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:56:49.876014Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-459",
"description": "CWE-459 Incomplete Cleanup",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:56:54.437Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-496"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Xen 4.21 and onwards are vulnerable. Xen 4.20 and older are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Grygorii Strashko of EPAM."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Xenstore, to have an up-to-date picture of the entire system, wants to\nknow of domains appearing and disappearing. To make this more robust, a\nnew XEN_DOMCTL_get_domain_state was introduced. The management of the\nbitmap underlying that operation is tied into the binding of the\nVIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear\ndown the bitmap even in cases when it wasn\u0027t set up. Unprivileged domains\ncan trigger that error path."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged domain can affect the operation of Xenstore, potentially\nleading to a Denial of Service (DoS) affecting the entire host. A\nhypervisor crash with similar host wide effect also is possible, albeit\nunlikely."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:28.304Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-496.html"
}
],
"title": "vIRQ event channel binding may break Xenstore",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42492",
"datePublished": "2026-07-28T12:31:28.304Z",
"dateReserved": "2026-04-27T14:20:24.139Z",
"dateUpdated": "2026-07-28T16:33:22.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42493 (GCVE-0-2026-42493)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
x86 shadow paging is deprecated
Summary
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:58 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:23.792Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-495.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/12"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:58:19.075241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:58:45.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-495"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All x86 systems with builds of Xen having SHADOW_PAGING=y are affected.\nNote that prior to Xen 4.7 this control didn\u0027t exist, and all builds of\nXen would be affected. (Strictly speaking Xen 4.6 had a different, harder\nto use mechanism to disable shadow paging support: One could pass\n\"shadow-paging=n\" on the make command line.)"
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Addressing certain issues, in particular related to operations which may\ntake excessively long and therefore would need preemption, has turned out\noverly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly\navailable, the decision was to deprecate the functionality, while still\nretaining it for people to use at their own (security) risk. Memory-wise\nsmall enough guests may still be okay to run."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to cause Denial of Service (DoS)\naffecting the entire host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:11.950Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-495.html"
}
],
"title": "x86 shadow paging is deprecated",
"workarounds": [
{
"lang": "en",
"value": "Running HVM and PVH in Hardware Assisted Paging (HAP) mode will avoid this\nvulnerability.\n\nThere\u0027s no mitigation available for PV guests. This is because shadow\nmode, if support is enabled in the hypervisor, could be engaged at any\ntime. Note that without shadow mode built into Xen, guests not properly\ndealing with L1TF will simply be crashed instead."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42493",
"datePublished": "2026-07-28T12:31:11.950Z",
"dateReserved": "2026-04-27T14:20:24.139Z",
"dateUpdated": "2026-07-28T16:33:23.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42486 (GCVE-0-2026-42486)
Vulnerability from cvelistv5 – Published: 2026-07-09 15:16 – Updated: 2026-07-10 03:55
VLAI
EPSS
VEX
Title
Multiple RBAC issues in XAPI
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different users with different roles, using Role
Based Access Control. For more details, see:
https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles
The pool-admin role is fully privileged. Notably, users with this role
can also SSH into the host as root.
The other administrator roles are pool-operator, vm-power-admin and
vm-admin, each of which are authorised to configure and manage various
aspects of the system.
Some settings are inadequately restricted, and can be set by a lower
privilege of administrator than expected.
* CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and
turn arbitrary files in dom0 into VDIs (virtual disks) and give said
disks to a VM they control. This is an arbitrary read and/or modify
of files in dom0.
* CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain
and mark a VM as a system domain. System domains are ignored and
left running during certain other host/pool operations, and may be
hidden from view in tooling.
* CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain
and mark a VM as the storage domain for a particular host storage
connection (PBD). Shutting down the VM can cause the PBD to be
erroneously marked as unplugged when it is not.
* CVE-2026-23562: Configuration of PCI passthrough is normally
restricted to the pool-admin role. However one API was missing this
check, allowing a vm-admin access to unintended host hardware.
* CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial
parameter, which should be restricted to the pool-admin role, as it
can allow arbitrary dom0 file write.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 00:00 UTC
CWE
- CWE-250 - Execution with unnecessary privileges
Assigner
References
1 reference
Date Public
2026-04-28 18:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42486",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T03:55:43.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "XAPI",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2026-04-28T18:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\u003cbr\u003eXAPI can configure different users with different roles, using Role\u003cbr\u003eBased Access Control. For more details, see:\u003cbr\u003e\u003cbr\u003e https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\u003cbr\u003e\u003cbr\u003eThe pool-admin role is fully privileged. Notably, users with this role\u003cbr\u003ecan also SSH into the host as root.\u003cbr\u003e\u003cbr\u003eThe other administrator roles are pool-operator, vm-power-admin and\u003cbr\u003evm-admin, each of which are authorised to configure and manage various\u003cbr\u003easpects of the system.\u003cbr\u003e\u003cbr\u003eSome settings are inadequately restricted, and can be set by a lower\u003cbr\u003eprivilege of administrator than expected.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\u003cbr\u003e turn arbitrary files in dom0 into VDIs (virtual disks) and give said\u003cbr\u003e disks to a VM they control. This is an arbitrary read and/or modify\u003cbr\u003e of files in dom0.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\u003cbr\u003e and mark a VM as a system domain. System domains are ignored and\u003cbr\u003e left running during certain other host/pool operations, and may be\u003cbr\u003e hidden from view in tooling.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\u003cbr\u003e and mark a VM as the storage domain for a particular host storage\u003cbr\u003e connection (PBD). Shutting down the VM can cause the PBD to be\u003cbr\u003e erroneously marked as unplugged when it is not.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23562: Configuration of PCI passthrough is normally\u003cbr\u003e restricted to the pool-admin role. However one API was missing this\u003cbr\u003e check, allowing a vm-admin access to unintended host hardware.\u003cbr\u003e\u003cbr\u003e * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\u003cbr\u003e parameter, which should be restricted to the pool-admin role, as it\u003cbr\u003e can allow arbitrary dom0 file write."
}
],
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\nXAPI can configure different users with different roles, using Role\nBased Access Control. For more details, see:\n\n https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\n\nThe pool-admin role is fully privileged. Notably, users with this role\ncan also SSH into the host as root.\n\nThe other administrator roles are pool-operator, vm-power-admin and\nvm-admin, each of which are authorised to configure and manage various\naspects of the system.\n\nSome settings are inadequately restricted, and can be set by a lower\nprivilege of administrator than expected.\n\n * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\n turn arbitrary files in dom0 into VDIs (virtual disks) and give said\n disks to a VM they control. This is an arbitrary read and/or modify\n of files in dom0.\n\n * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\n and mark a VM as a system domain. System domains are ignored and\n left running during certain other host/pool operations, and may be\n hidden from view in tooling.\n\n * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\n and mark a VM as the storage domain for a particular host storage\n connection (PBD). Shutting down the VM can cause the PBD to be\n erroneously marked as unplugged when it is not.\n\n * CVE-2026-23562: Configuration of PCI passthrough is normally\n restricted to the pool-admin role. However one API was missing this\n check, allowing a vm-admin access to unintended host hardware.\n\n * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\n parameter, which should be restricted to the pool-admin role, as it\n can allow arbitrary dom0 file write."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with unnecessary privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:16:34.880Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-489.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple RBAC issues in XAPI",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42486",
"datePublished": "2026-07-09T15:16:34.880Z",
"dateReserved": "2026-04-27T14:20:24.138Z",
"dateUpdated": "2026-07-10T03:55:43.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}