Skip to content
OpenAdvisories
High WID-SEC-2026-3248 3 CVEs

Xen: Mehrere Schwachstellen

Published Sep 8, 2026 · Updated Nov 9, 2026 · Revision 6 · de

Vendor: Debian Vendor: Fedora Vendor: SUSE Product: Linux Product: Linux Product: Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Xen ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.

Product

Xen ist ein Virtueller-Maschinen-Monitor (VMM), der Hardware (x86, IA-64, PowerPC) für die darauf laufenden Systeme (Domains) paravirtualisiert.

Vulnerabilities 3

  • High 8.8
    CVE-2026-79602

    x86: improper handling of HVM emulation return codes

    A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-62437

    x86: DMs may cause mem leak by IRQ binding

    When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfor…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2026-79603

    Unconditionally do TLB flushing ahead of page scrubbing

    x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where …

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine

Revision history

  1. #6

    Neue Updates von SUSE aufgenommen

  2. #5

    Neue Updates von Debian aufgenommen

  3. #4

    Neue Updates von Debian aufgenommen

  4. #3

    Neue Updates von Fedora aufgenommen

  5. #2

    Neue Updates von SUSE aufgenommen

  6. #1

    Initiale Fassung

References