SB2026081034 - Debian update for xen
Published: August 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 39 vulnerabilities.
1) Improper locking (CVE-ID: CVE-2026-62427)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in platform operations when acquiring the system-wide platform-op lock. A local user can issue platform operations in a way that stalls other entities to cause a denial of service.
With XSM/Flask in use, lock acquisition for some operations occurs before permission checking.
2) Improper locking (CVE-ID: CVE-2026-42489)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper lock management in domctl operations when acquiring a system-wide lock for operations that may not be executed in parallel. A local user can repeatedly invoke domctl operations to cause a denial of service.
The issue can allow a less privileged entity to stall an equally or more privileged entity, potentially affecting the entire host.
3) Improper access control (CVE-ID: CVE-2026-42490)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper access control in domctl operations when acquiring the system-wide lock before permission checking for some operations with XSM/Flask in use. A local user can invoke domctl operations that acquire the lock before permission checks to cause a denial of service.
This issue occurs only when XSM/Flask is in use.
4) Resource exhaustion (CVE-ID: CVE-2026-42493)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in x86 shadow paging when handling guest shadow paging operations. A local user can run an unprivileged guest to cause a denial of service.
The issue affects the entire host.
5) Input validation error (CVE-ID: CVE-2026-42494)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to an out-of-bounds read or write in libfsimage's iso9660 directory record loop when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
6) Integer underflow (CVE-ID: CVE-2026-42495)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to an integer underflow in libfsimage's iso9660 System Use area calculation when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
7) Input validation error (CVE-ID: CVE-2026-62423)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to an out-of-bounds read or write in libfsimage's iso9660 Rock Ridge extension loop when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
8) Input validation error (CVE-ID: CVE-2026-62424)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper input validation in libfsimage's iso9660 Rock Ridge NM record processing when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
9) Input validation error (CVE-ID: CVE-2026-62425)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper input validation in libfsimage's iso9660 Rock Ridge CE record processing when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
10) Improper locking (CVE-ID: CVE-2026-62426)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in sysctl operations when acquiring the system-wide sysctl lock. A local user can issue sysctl operations in a way that stalls other entities to cause a denial of service.
With XSM/Flask in use, lock acquisition for some operations occurs before permission checking.
11) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-42488)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges, cause a denial of service, or disclose sensitive information.
The vulnerability exists due to improper state management in the x86 shadow paging mapcache metadata handling when switching page tables on certain shadow paging error paths. A local user can trigger the affected shadow mode conditions from a 64-bit PV guest to escalate privileges, cause a denial of service, or disclose sensitive information.
Only x86 systems are affected, and exploitation is possible only from 64-bit PV guests running in shadow mode.
12) Type Confusion (CVE-ID: CVE-2026-62428)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to type confusion in grant-copy operations when processing grant-copy requests involving a pinned grant. A local user can trigger concurrent grant operations to escalate privileges.
Information disclosure and denial of service are also possible. Systems built without grant table support are not vulnerable.
13) Race condition (CVE-ID: CVE-2026-62429)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or escalate privileges.
The vulnerability exists due to a race condition in the vNUMA configuration cleanup logic when accessing vNUMA configuration data during domain destruction. A local user can trigger concurrent access to stale configuration data to cause a denial of service, disclose sensitive information, or escalate privileges.
Only entities controlling HVM guests can leverage the issue, and only when vNUMA is enabled for the guest.
14) Out-of-bounds read (CVE-ID: CVE-2026-62430)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in vRTC emulation when handling indirect CMOS memory index accesses. A local user can change the cached index concurrently after it has been checked to disclose sensitive information.
The disclosed data is limited to Xen data and does not include data belonging to other guests.
15) Division by zero (CVE-ID: CVE-2026-62431)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to division by zero in the periodic Viridian STIMER handling logic when processing a user-controlled divisor value. A local user can set the divisor to zero to cause a denial of service.
Only HVM guests with Viridian STIMERs enabled can trigger the vulnerability.
16) Race condition (CVE-ID: CVE-2026-62432)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a race condition in the EVTCHNOP_expand_array hypercall when checking whether FIFO event channels are enabled without holding the correct lock. A local attacker can trigger EVTCHNOP_expand_array to race with EVTCHNOP_reset to cause a denial of service.
The issue affects malicious guest contexts, including HVM guests on x86 or ARM and PVH guests; x86 PV guests may also be able to trigger memory corruption or privilege escalation.
17) Input validation error (CVE-ID: CVE-2026-62433)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper input validation in the DM_OP handling code when processing DM_OP hypercalls. A local user can provide an insufficient number of buffers for certain operations to disclose sensitive information.
Only entities controlling HVM guests can leverage the vulnerability, such as device models running in a stub domain or de-privileged in Dom0.
18) Out-of-bounds write (CVE-ID: CVE-2026-62434)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to memory corruption in Xen memory management state when reclaiming special pages in populate-on-demand guests. A local user can attempt to reclaim pages that are not regular guest ram to cause a denial of service.
Only x86 HVM and PVH guests started in populate-on-demand mode are believed to be able to leverage the vulnerability.
19) Race condition (CVE-ID: CVE-2026-62435)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to a race condition in grant-table version switching logic when switching from grant table v1 to v2 while other grant-table operations are in progress. A local user can trigger concurrent grant-table operations in a multi-vCPU guest to escalate privileges.
Only x86 guests permitted to use grant table version 2 interfaces are vulnerable, and exploitation requires a multi-vCPU guest.
20) Race condition (CVE-ID: CVE-2026-62436)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to a race condition in grant-table version switching logic when switching from grant table v2 to v1 while other grant-table operations are in progress. A local user can trigger concurrent grant-table operations in a multi-vCPU guest to escalate privileges.
Only x86 guests permitted to use grant table version 2 interfaces are vulnerable, and exploitation requires a multi-vCPU guest.
21) Improper access control (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to improper access control in Stage 2 translation handling when invalidating translation lookaside buffer entries on affected Arm systems. A local user can trigger writes from a malicious guest after write permissions have been revoked to escalate privileges.
Only Xen on Arm in multi-core configurations is affected. The issue does not affect reads.
22) Race condition (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.
The vulnerability exists due to improper memory synchronization in broadcast TLB invalidation completion handling in the arm64 CPU errata handling for affected Arm CPUs when performing broadcast TLB invalidation sequences. A local user can trigger memory accesses relying on an invalidated TLB entry to disclose sensitive information, modify data, or cause a denial of service.
The issue affects only the completion of memory accesses translated by an invalidated TLB entry; the TLB entries themselves are still invalidated correctly.
23) Improper locking (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.
The vulnerability exists due to improper memory access ordering in arm64 TLB invalidation handling when performing broadcast TLB invalidation on affected Arm CPUs. A local user can trigger affected memory access completion conditions to disclose sensitive information, modify data, or cause a denial of service.
The issue affects only memory accesses translated by an invalidated TLB entry; TLB entries themselves are still invalidated correctly.
24) Improper locking (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.
The vulnerability exists due to improper synchronization in broadcast TLB invalidation handling in the arm64 TLB invalidation logic when processing TLBI and DSB sequences on affected Arm CPUs. A local user can trigger memory accesses involving translations from an invalidated TLB entry to disclose sensitive information, modify data, or cause a denial of service.
The issue affects only the completion of memory accesses translated by an invalidated TLB entry and does not prevent the actual invalidation of TLB entries.
25) Improper locking (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper hardware synchronization in broadcast TLBI completion on affected arm64 CPUs when performing broadcast TLB invalidation. A local user can trigger memory access activity that relies on an invalidated TLB entry to cause a denial of service.
The issue affects only the completion of memory accesses translated by an invalidated TLB entry; the TLB invalidation itself still occurs correctly.
26) Race condition (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in broadcast TLBI completion in the arm64 TLB invalidation handling when performing broadcast TLB invalidation on affected Arm CPUs. A local user can trigger memory access patterns that rely on invalidated TLB entries to cause a denial of service.
The issue affects the completion of memory accesses translated by an invalidated TLB entry, while the TLB invalidation itself still occurs correctly.
27) Race condition (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in broadcast TLB invalidation completion handling in the arm64 CPU errata logic when performing memory accesses translated by an invalidated TLB entry after a TLBI;DSB sequence. A local user can trigger affected memory access patterns to cause a denial of service.
The issue affects certain Arm CPUs on arm64 systems and does not prevent invalidation of TLB entries themselves.
28) Improper locking (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper hardware synchronization in arm64 TLB invalidation handling when processing broadcast TLB invalidation sequences on affected Arm CPUs. A local user can trigger memory accesses that rely on an invalidated TLB entry to cause a denial of service.
The issue affects only the completion of memory accesses translated by an invalidated TLB entry and does not affect the actual invalidation of TLB entries.
29) Race condition (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in broadcast TLB invalidation completion handling in the arm64 TLB invalidation logic when performing memory accesses translated by an invalidated TLB entry after a TLBI;DSB sequence. A local user can trigger affected memory access patterns to cause a denial of service.
The issue affects only the completion of memory accesses translated by an invalidated TLB entry and does not prevent the actual invalidation of TLB entries.
30) Improper locking (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper memory synchronization in broadcast TLB invalidation completion handling in the arm64 CPU errata logic when performing broadcast TLB invalidation on affected Arm CPUs. A local user can trigger memory access patterns that rely on invalidated TLB entries to cause a denial of service.
The issue affects only completion of memory accesses translated by an invalidated TLB entry and does not prevent the actual invalidation of TLB entries.
31) Improper locking (CVE-ID: CVE-2025-10263)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.
The vulnerability exists due to improper memory synchronization in broadcast TLBI completion in the arm64 TLB invalidation handling when performing broadcast TLB invalidation on affected Arm CPUs. A local user can trigger affected memory access patterns to disclose sensitive information, modify data, or cause a denial of service.
The issue affects completion of memory accesses translated by an invalidated TLB entry, while TLB entries themselves are still invalidated correctly.
32) Observable discrepancy (CVE-ID: CVE-2025-54505)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to transient execution in floating-point divisor unit when executing floating-point operations in privileged code. A local user can sample data from the floating-point divisor unit to disclose sensitive information.
The issue affects systems with SMT enabled as well as systems without SMT.
33) Improper privilege management (CVE-ID: CVE-2025-54518)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to improper privilege management in x86 CPU opcode cache handling when executing code on affected AMD Fam17h CPUs. A local user can execute code to escalate privileges.
The issue can permit escalation across privilege boundaries including userspace to kernel and guest to host, and only AMD Fam17h CPUs based on the Zen2 microarchitecture are believed to be affected.
34) Use-after-free (CVE-ID: CVE-2026-23554)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H]
The vulnerability allows a local user to escalate privileges, cause a denial of service, and leak information.
The vulnerability exists due to a use after free in the Intel EPT paging structures when modifying page mappings under the p2m lock. A local user on the guest OS can trigger the premature release of paging structures before cached EPT state is flushed, leading to stale entries in the cache that reference freed memory. This can result in access to unintended memory regions of the hypervisor.
The vulnerability affects x86 Intel systems with EPT support running Xen 4.17 or later. Only x86 HVM/PVH guests using HAP are able to leverage the vulnerability. Exploitation does not require additional privileges beyond those of a normal guest user, but access to a guest VM is required.
35) Reachable assertion (CVE-ID: CVE-2026-23555)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: 6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H]
The vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to improper input validation in xenstored when processing Xenstore commands with the node path of "/local/domain/". A local user can send a specially crafted request containing this illegal path to crash xenstored or force it into an infinite loop, resulting in a denial of service for Xenstore operations.
Exploitation does not require guest privileges beyond the ability to issue Xenstore commands. The vulnerability affects systems using the C variant of xenstored; systems using oxenstored or xenstore-stubdom are not affected.
36) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-23556)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper resource management in oxenstored quota use counts when tearing down and reusing domain IDs. A remote user can deliberately hit its quota and reboot a domain to cause a denial of service.
Only systems configured to use oxenstored are vulnerable.
37) Reachable assertion (CVE-ID: CVE-2026-23557)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an assertion failure in xenstored when processing an XS_RESET_WATCHES command within a transaction. A remote attacker can issue a crafted XS_RESET_WATCHES command within a transaction to cause a denial of service.
Only systems using the C variant of xenstored or xenstore-stubdom built without NDEBUG are vulnerable.
38) Race condition (CVE-ID: CVE-2026-23558)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges, disclose sensitive information, or cause a denial of service.
The vulnerability exists due to a race condition in status page mapping via XENMEM_add_to_physmap when changing the grant table version from v2 to v1 in parallel with mapping status pages. A remote user can trigger concurrent grant table version changes and status page mappings to escalate privileges, disclose sensitive information, or cause a denial of service.
Only x86 HVM and PVH guests permitted to use grant table version 2 interfaces can leverage this vulnerability.
39) Race condition (CVE-ID: CVE-2026-42487)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper synchronization in the I/O port mapping list traversal logic when handling guest I/O port accesses. A remote user can modify I/O port mappings during traversal to cause a denial of service.
Only x86 systems are vulnerable. Exploitation requires control of an HVM guest device model running in a stub domain or de-privileged in Dom0.
Remediation
Install update from vendor's website.