SB2026073008 - SUSE update for xen
Published: July 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-42493)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in x86 shadow paging when handling guest shadow paging operations. A local user can run an unprivileged guest to cause a denial of service.
The issue affects the entire host.
2) Input validation error (CVE-ID: CVE-2026-42494)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to an out-of-bounds read or write in libfsimage's iso9660 directory record loop when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
3) Integer underflow (CVE-ID: CVE-2026-42495)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to an integer underflow in libfsimage's iso9660 System Use area calculation when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
4) Input validation error (CVE-ID: CVE-2026-62423)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to an out-of-bounds read or write in libfsimage's iso9660 Rock Ridge extension loop when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
5) Input validation error (CVE-ID: CVE-2026-62424)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper input validation in libfsimage's iso9660 Rock Ridge NM record processing when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
6) Input validation error (CVE-ID: CVE-2026-62425)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper input validation in libfsimage's iso9660 Rock Ridge CE record processing when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
7) Improper locking (CVE-ID: CVE-2026-62426)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in sysctl operations when acquiring the system-wide sysctl lock. A local user can issue sysctl operations in a way that stalls other entities to cause a denial of service.
With XSM/Flask in use, lock acquisition for some operations occurs before permission checking.
8) Improper locking (CVE-ID: CVE-2026-62427)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in platform operations when acquiring the system-wide platform-op lock. A local user can issue platform operations in a way that stalls other entities to cause a denial of service.
With XSM/Flask in use, lock acquisition for some operations occurs before permission checking.
9) Type Confusion (CVE-ID: CVE-2026-62428)
CWE-ID: CWE-843 - Type confusion
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to type confusion in grant-copy operations when processing grant-copy requests involving a pinned grant. A local user can trigger concurrent grant operations to escalate privileges.
Information disclosure and denial of service are also possible. Systems built without grant table support are not vulnerable.
10) Race condition (CVE-ID: CVE-2026-62429)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or escalate privileges.
The vulnerability exists due to a race condition in the vNUMA configuration cleanup logic when accessing vNUMA configuration data during domain destruction. A local user can trigger concurrent access to stale configuration data to cause a denial of service, disclose sensitive information, or escalate privileges.
Only entities controlling HVM guests can leverage the issue, and only when vNUMA is enabled for the guest.
11) Out-of-bounds read (CVE-ID: CVE-2026-62430)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in vRTC emulation when handling indirect CMOS memory index accesses. A local user can change the cached index concurrently after it has been checked to disclose sensitive information.
The disclosed data is limited to Xen data and does not include data belonging to other guests.
12) Division by zero (CVE-ID: CVE-2026-62431)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to division by zero in the periodic Viridian STIMER handling logic when processing a user-controlled divisor value. A local user can set the divisor to zero to cause a denial of service.
Only HVM guests with Viridian STIMERs enabled can trigger the vulnerability.
13) Race condition (CVE-ID: CVE-2026-62432)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a race condition in the EVTCHNOP_expand_array hypercall when checking whether FIFO event channels are enabled without holding the correct lock. A local attacker can trigger EVTCHNOP_expand_array to race with EVTCHNOP_reset to cause a denial of service.
The issue affects malicious guest contexts, including HVM guests on x86 or ARM and PVH guests; x86 PV guests may also be able to trigger memory corruption or privilege escalation.
14) Input validation error (CVE-ID: CVE-2026-62433)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper input validation in the DM_OP handling code when processing DM_OP hypercalls. A local user can provide an insufficient number of buffers for certain operations to disclose sensitive information.
Only entities controlling HVM guests can leverage the vulnerability, such as device models running in a stub domain or de-privileged in Dom0.
15) Out-of-bounds write (CVE-ID: CVE-2026-62434)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to memory corruption in Xen memory management state when reclaiming special pages in populate-on-demand guests. A local user can attempt to reclaim pages that are not regular guest ram to cause a denial of service.
Only x86 HVM and PVH guests started in populate-on-demand mode are believed to be able to leverage the vulnerability.
Remediation
Install update from vendor's website.