Skip to content
OpenAdvisories
High WID-SEC-2026-2568 18 CVEs

Xen: Mehrere Schwachstellen

Published Jul 28, 2026 · Updated Oct 4, 2026 · Revision 8 · de-DE

Vendor: Citrix Vendor: Debian Vendor: Fedora Vendor: SUSE Product: Linux Product: Linux Product: Linux Product: openSUSE Product: XenServer Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Xen ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

Xen ist ein Virtueller-Maschinen-Monitor (VMM), der Hardware (x86, IA-64, PowerPC) für die darauf laufenden Systeme (Domains) paravirtualisiert.

Vulnerabilities 18

  • High 8.8
    CVE-2026-62426

    sysctl and platform-op locks open to abuse

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these o…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • High 8.8
    CVE-2026-62427

    sysctl and platform-op locks open to abuse

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these o…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • High 7.8
    CVE-2026-62428

    grant-table: type confusion in grant-copy

    When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-42492

    vIRQ event channel binding may break Xenstore

    Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN_DOMCTL_get_domain_state was introduced. The management of the bitmap underlying that operation is tied into …

    Xen Xen xen xen Virtualization Ubuntu Alpine
  • High 7.5
    CVE-2026-42493

    x86 shadow paging is deprecated

    Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-62430

    x86: Out-of-bounds read in vRTC emulation

    Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could cha…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-62431

    Viridian STIMER division by zero

    The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • High 7.3
    CVE-2026-62432

    evtchn: Race between FIFO expand and reset

    The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • High 7.3
    CVE-2026-62433

    correct buffer checks for DM_OP hypercalls

    Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-62429

    vNUMA domain cleanup may race other operations

    Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-62435

    grant-table: version change racing with other operations

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduce…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-62436

    grant-table: version change racing with other operations

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduce…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 6.1
    CVE-2026-42494

    buffer overruns in libfsimage iso9660 handling

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled …

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-42495

    buffer overruns in libfsimage iso9660 handling

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled …

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-62423

    buffer overruns in libfsimage iso9660 handling

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled …

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-62424

    buffer overruns in libfsimage iso9660 handling

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled …

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-62425

    buffer overruns in libfsimage iso9660 handling

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled …

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-62434

    PoD: Don't try to reclaim special pages

    A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine

Revision history

  1. #8

    Neue Updates von Debian aufgenommen

  2. #7

    Neue Updates von SUSE aufgenommen

  3. #6

    Neue Updates von Debian aufgenommen

  4. #5

    Neue Updates von openSUSE aufgenommen

  5. #4

    Neue Updates von SUSE aufgenommen

  6. #3

    Neue Updates von Fedora und SUSE aufgenommen

  7. #2

    Neue Updates von SUSE und Citrix aufgenommen

  8. #1

    Initiale Fassung

References