SB2026090873 - SUSE update for xen
Published: September 8, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 18 vulnerabilities.
1) Race condition (CVE-ID: CVE-2026-62429)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or escalate privileges.
The vulnerability exists due to a race condition in the vNUMA configuration cleanup logic when accessing vNUMA configuration data during domain destruction. A local user can trigger concurrent access to stale configuration data to cause a denial of service, disclose sensitive information, or escalate privileges.
Only entities controlling HVM guests can leverage the issue, and only when vNUMA is enabled for the guest.
2) Race condition (CVE-ID: CVE-2026-79603)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass intended isolation between guests.
The vulnerability exists due to a race condition between TLB flushing and page scrubbing in Xen\'s x86 PV guest memory management when freeing memory pages while retaining stale TLB entries. A local user can free a memory page while retaining a stale TLB entry to bypass intended isolation between guests.
Only x86 PV guests are affected, and exploitation is relevant when xsm=silo scrub-domheap is configured.
3) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-79602)
CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of HVM emulation return codes in Xen HVM emulation when processing a guest with an assigned PCI device containing an I/O BAR. A local user can trigger a BUG() in Xen to cause a denial of service.
Only x86 systems are affected.
4) Memory leak (CVE-ID: CVE-2026-62437)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper cleanup of IRQ tracking structures in Xen\'s PCI device and IRQ cleanup handling when an HVM guest with assigned PCI devices is being terminated. A local user can cause the device model to bind IRQs anew during guest termination to cause a denial of service.
5) Out-of-bounds write (CVE-ID: CVE-2026-62434)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to memory corruption in Xen memory management state when reclaiming special pages in populate-on-demand guests. A local user can attempt to reclaim pages that are not regular guest ram to cause a denial of service.
Only x86 HVM and PVH guests started in populate-on-demand mode are believed to be able to leverage the vulnerability.
6) Input validation error (CVE-ID: CVE-2026-62433)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper input validation in the DM_OP handling code when processing DM_OP hypercalls. A local user can provide an insufficient number of buffers for certain operations to disclose sensitive information.
Only entities controlling HVM guests can leverage the vulnerability, such as device models running in a stub domain or de-privileged in Dom0.
7) Race condition (CVE-ID: CVE-2026-62432)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a race condition in the EVTCHNOP_expand_array hypercall when checking whether FIFO event channels are enabled without holding the correct lock. A local attacker can trigger EVTCHNOP_expand_array to race with EVTCHNOP_reset to cause a denial of service.
The issue affects malicious guest contexts, including HVM guests on x86 or ARM and PVH guests; x86 PV guests may also be able to trigger memory corruption or privilege escalation.
8) Division by zero (CVE-ID: CVE-2026-62431)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to division by zero in the periodic Viridian STIMER handling logic when processing a user-controlled divisor value. A local user can set the divisor to zero to cause a denial of service.
Only HVM guests with Viridian STIMERs enabled can trigger the vulnerability.
9) Out-of-bounds read (CVE-ID: CVE-2026-62430)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in vRTC emulation when handling indirect CMOS memory index accesses. A local user can change the cached index concurrently after it has been checked to disclose sensitive information.
The disclosed data is limited to Xen data and does not include data belonging to other guests.
10) Resource exhaustion (CVE-ID: CVE-2026-42493)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in x86 shadow paging when handling guest shadow paging operations. A local user can run an unprivileged guest to cause a denial of service.
The issue affects the entire host.
11) Type Confusion (CVE-ID: CVE-2026-62428)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to type confusion in grant-copy operations when processing grant-copy requests involving a pinned grant. A local user can trigger concurrent grant operations to escalate privileges.
Information disclosure and denial of service are also possible. Systems built without grant table support are not vulnerable.
12) Improper locking (CVE-ID: CVE-2026-62427)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in platform operations when acquiring the system-wide platform-op lock. A local user can issue platform operations in a way that stalls other entities to cause a denial of service.
With XSM/Flask in use, lock acquisition for some operations occurs before permission checking.
13) Improper locking (CVE-ID: CVE-2026-62426)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in sysctl operations when acquiring the system-wide sysctl lock. A local user can issue sysctl operations in a way that stalls other entities to cause a denial of service.
With XSM/Flask in use, lock acquisition for some operations occurs before permission checking.
14) Input validation error (CVE-ID: CVE-2026-62425)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper input validation in libfsimage's iso9660 Rock Ridge CE record processing when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
15) Input validation error (CVE-ID: CVE-2026-62424)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper input validation in libfsimage's iso9660 Rock Ridge NM record processing when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
16) Input validation error (CVE-ID: CVE-2026-62423)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to an out-of-bounds read or write in libfsimage's iso9660 Rock Ridge extension loop when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
17) Integer underflow (CVE-ID: CVE-2026-42495)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to an integer underflow in libfsimage's iso9660 System Use area calculation when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
18) Input validation error (CVE-ID: CVE-2026-42494)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to an out-of-bounds read or write in libfsimage's iso9660 directory record loop when parsing a crafted iso9660 filesystem image. A remote user can provide a crafted disk image to pygrub to escalate privileges.
Exploitation requires a guest to use the pygrub bootloader.
Remediation
Install update from vendor's website.