SB2026101817 - Debian update for xen
Published: October 18, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Memory leak (CVE-ID: CVE-2026-62437)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper cleanup of IRQ tracking structures in Xen's PCI device and IRQ cleanup handling when an HVM guest with assigned PCI devices is being terminated. A local user can cause the device model to bind IRQs anew during guest termination to cause a denial of service.
2) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-79602)
CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of HVM emulation return codes in Xen HVM emulation when processing a guest with an assigned PCI device containing an I/O BAR. A local user can trigger a BUG() in Xen to cause a denial of service.
Only x86 systems are affected.
3) Race condition (CVE-ID: CVE-2026-79603)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass intended isolation between guests.
The vulnerability exists due to a race condition between TLB flushing and page scrubbing in Xen's x86 PV guest memory management when freeing memory pages while retaining stale TLB entries. A local user can free a memory page while retaining a stale TLB entry to bypass intended isolation between guests.
Only x86 PV guests are affected, and exploitation is relevant when xsm=silo scrub-domheap is configured.
4) Resource exhaustion (CVE-ID: CVE-2026-79604)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in oxenstored when handling xenbus reconnect requests. A local user can repeatedly request xenbus reconnects to cause a denial of service.
Only systems using the Ocaml Xenstored implementation are affected.
5) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-79608)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information from other contexts on the same processor core.
The vulnerability exists due to an inverted conditional in Xen's Zenbleed workaround when determining whether the workaround needs to be applied. A local user can exploit the failure to apply the required workaround to disclose sensitive information from other contexts on the same processor core.
Exploitation is limited to systems using the AMD Zen2 microarchitecture with out-of-date microcode. Exposed data can include cryptographic key material, ciphertext and plaintext processed by AES-NI instructions, and data processed by REP-MOVS instructions.
6) Buffer overflow (CVE-ID: CVE-2026-79609)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to those of the host, disclose information pertaining to other guests, or cause a denial of service affecting the entire host.
The vulnerability exists due to incomplete directmap coverage of guest memory in the x86 XPTI page-table copying mechanism when reading guest-chosen root page tables through the directmap. A local user can use a 64-bit PV guest with a root page table outside the directmap's coverage to escalate privileges to those of the host, disclose information pertaining to other guests, or cause a denial of service affecting the entire host.
Only x86 systems with RAM above the 5 TiB boundary, or the 3.5 TiB boundary when CONFIG_BIGMEM=y, are affected. HVM and PVH guests cannot leverage the vulnerability.
7) Race condition (CVE-ID: CVE-2026-79610)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to those of the host, disclose sensitive information, or cause a denial of service.
The vulnerability exists due to a race condition in Xen's grant-table subsystem when changing grant table versions frees and reallocates status pages, leaving previously calculated status-array pointers stale. A local user can trigger concurrent grant table version changes from v2 to v1 and back to v2 to escalate privileges to those of the host, disclose sensitive information, or cause a denial of service.
Exploitation requires an x86 guest with multiple vCPUs that is permitted to use grant table version 2 interfaces, and a hypervisor built with grant table support enabled.
8) Improper handling of exceptional conditions (CVE-ID: CVE-2026-79611)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service in the guest.
The vulnerability exists due to improper handling of processor debug states in the VMX VM-entry state adjustment logic when branch tracing is enabled, debug exceptions are intercepted, single stepping is active, and blocking by STI or MOV SS is active. A local user can execute userspace code in an HVM or PVH guest that triggers this state combination to cause a denial of service in the guest.
Only systems supporting VMX hardware virtualization extensions on Intel, VIA, or Zhaoxin CPUs are affected.
9) Integer underflow (CVE-ID: CVE-2026-102699)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service affecting the entire host.
The vulnerability exists due to integer underflow in GNTTABOP_cache_flush when calculating guest cache-flush operations. A local user can issue a cache-flush operation that triggers the underflow to cause a denial of service affecting the entire host.
Only Arm systems are vulnerable. On 64-bit Arm, the resulting loop can take excessively long and is likely to eventually crash the hypervisor.
10) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-102700)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to failure to release a page reference in the GNTTAB_cache_flush error path when handling a cache-flush operation for a page owned by a special system domain. A local user can invoke the operation for such a page to cause a denial of service.
Only x86 systems are vulnerable. The relevant system domains are DOM_IO and DOM_COW. The most likely outcome affects Domain 0, potentially affecting the entire host, or another domain.
11) Incorrect authorization (CVE-ID: CVE-2026-102702)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt memory belonging to another domain.
The vulnerability exists due to improper authorization in GNTTABOP_cache_flush when handling cache-flush operations on memory mapped from another domain through the grant table interface. A local user can issue an invalidate-without-clean operation against a read-only grant mapping to corrupt memory belonging to another domain.
Only Arm systems are vulnerable.
Remediation
Install update from vendor's website.