SB2026072966 - Multiple vulnerabilities in Xen

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072966

SB2026072966 - Multiple vulnerabilities in Xen

Published: July 29, 2026

Security Bulletin ID SB2026072966
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 19
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 32% Low 68%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 19 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-62430)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in vRTC emulation when handling indirect CMOS memory index accesses. A local user can change the cached index concurrently after it has been checked to disclose sensitive information.

The disclosed data is limited to Xen data and does not include data belonging to other guests.


2) Input validation error (CVE-ID: CVE-2026-62424)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper input validation in libfsimage's iso9660 Rock Ridge NM record processing when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.

Exploitation requires a guest to use the pygrub bootloader.


3) Input validation error (CVE-ID: CVE-2026-62423)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to an out-of-bounds read or write in libfsimage's iso9660 Rock Ridge extension loop when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.

Exploitation requires a guest to use the pygrub bootloader.


4) Integer underflow (CVE-ID: CVE-2026-42495)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to an integer underflow in libfsimage's iso9660 System Use area calculation when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.

Exploitation requires a guest to use the pygrub bootloader.


5) Input validation error (CVE-ID: CVE-2026-42494)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to an out-of-bounds read or write in libfsimage's iso9660 directory record loop when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.

Exploitation requires a guest to use the pygrub bootloader.


6) Improper locking (CVE-ID: CVE-2026-62427)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in platform operations when acquiring the system-wide platform-op lock. A local user can issue platform operations in a way that stalls other entities to cause a denial of service.

With XSM/Flask in use, lock acquisition for some operations occurs before permission checking.


7) Improper locking (CVE-ID: CVE-2026-62426)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in sysctl operations when acquiring the system-wide sysctl lock. A local user can issue sysctl operations in a way that stalls other entities to cause a denial of service.

With XSM/Flask in use, lock acquisition for some operations occurs before permission checking.


8) Race condition (CVE-ID: CVE-2026-62436)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a race condition in grant-table version switching logic when switching from grant table v2 to v1 while other grant-table operations are in progress. A local user can trigger concurrent grant-table operations in a multi-vCPU guest to escalate privileges.

Only x86 guests permitted to use grant table version 2 interfaces are vulnerable, and exploitation requires a multi-vCPU guest.


9) Race condition (CVE-ID: CVE-2026-62435)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a race condition in grant-table version switching logic when switching from grant table v1 to v2 while other grant-table operations are in progress. A local user can trigger concurrent grant-table operations in a multi-vCPU guest to escalate privileges.

Only x86 guests permitted to use grant table version 2 interfaces are vulnerable, and exploitation requires a multi-vCPU guest.


10) Input validation error (CVE-ID: CVE-2026-62425)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper input validation in libfsimage's iso9660 Rock Ridge CE record processing when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.

Exploitation requires a guest to use the pygrub bootloader.


11) Input validation error (CVE-ID: CVE-2026-62433)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper input validation in the DM_OP handling code when processing DM_OP hypercalls. A local user can provide an insufficient number of buffers for certain operations to disclose sensitive information.

Only entities controlling HVM guests can leverage the vulnerability, such as device models running in a stub domain or de-privileged in Dom0.


12) Resource exhaustion (CVE-ID: CVE-2026-42493)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in x86 shadow paging when handling guest shadow paging operations. A local user can run an unprivileged guest to cause a denial of service.

The issue affects the entire host.


13) Improper Initialization (CVE-ID: CVE-2026-42492)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the VIRQ_DOM_EXC virtual IRQ binding logic when binding event channels. A local user can trigger an error path from an unprivileged domain to cause a denial of service.

A hypervisor crash with host-wide impact is also possible, although unlikely.


14) Type Confusion (CVE-ID: CVE-2026-62428)

CWE-ID: CWE-843 - Type confusion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to type confusion in grant-copy operations when processing grant-copy requests involving a pinned grant. A local user can trigger concurrent grant operations to escalate privileges.

Information disclosure and denial of service are also possible. Systems built without grant table support are not vulnerable.


15) Race condition (CVE-ID: CVE-2026-62429)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or escalate privileges.

The vulnerability exists due to a race condition in the vNUMA configuration cleanup logic when accessing vNUMA configuration data during domain destruction. A local user can trigger concurrent access to stale configuration data to cause a denial of service, disclose sensitive information, or escalate privileges.

Only entities controlling HVM guests can leverage the issue, and only when vNUMA is enabled for the guest.


16) Division by zero (CVE-ID: CVE-2026-62431)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the periodic Viridian STIMER handling logic when processing a user-controlled divisor value. A local user can set the divisor to zero to cause a denial of service.

Only HVM guests with Viridian STIMERs enabled can trigger the vulnerability.


17) Race condition (CVE-ID: CVE-2026-62432)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in the EVTCHNOP_expand_array hypercall when checking whether FIFO event channels are enabled without holding the correct lock. A local attacker can trigger EVTCHNOP_expand_array to race with EVTCHNOP_reset to cause a denial of service.

The issue affects malicious guest contexts, including HVM guests on x86 or ARM and PVH guests; x86 PV guests may also be able to trigger memory corruption or privilege escalation.


18) Out-of-bounds write (CVE-ID: CVE-2026-62434)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to memory corruption in Xen memory management state when reclaiming special pages in populate-on-demand guests. A local user can attempt to reclaim pages that are not regular guest ram to cause a denial of service.

Only x86 HVM and PVH guests started in populate-on-demand mode are believed to be able to leverage the vulnerability.


19) Improper privilege management (CVE-ID: N/A)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper isolation in pygrub when processing guest-controlled boot and file system data. A remote user can supply a crafted guest boot environment to escalate privileges.

Successful exploitation can give control equivalent to the domain construction tools, typically resulting in control of the host.


Remediation

Install update from vendor's website.

References