Resource exhaustion in Xen - CVE-2026-79604
Published: September 8, 2026
Vulnerability identifier: #VU147396
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-79604
CWE-ID: CWE-400
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in oxenstored when handling xenbus reconnect requests. A local user can repeatedly request xenbus reconnects to cause a denial of service.
Only systems using the Ocaml Xenstored implementation are affected.
Affected software
Xen
Debian Linux
Fedora
xen
xen (Debian package)
Debian Linux
Fedora
xen
xen (Debian package)
How to mitigate CVE-2026-79604
Install security update from vendor's website.
xen - update to 4.20.4-2.fc43
xen (Debian package) - update to 4.20.4+39-gf1e1321c87-0+deb13u1
xen (Debian package) - update to 4.20.4+39-gf1e1321c87-0+deb13u1