Description
An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage) because of lock mishandling upon detection of an add-to-physmap error.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.8.1-1+deb9u3 | — |
| Debian 13 | xen | 4.8.1-1+deb9u3 | — |
| Debian 12 | xen | 4.8.1-1+deb9u3 | — |
| Debian 9 | xen | 4.8.1-1+deb9u3 | DSA-3969-1 |
| Debian 8 | xen | 4.4.1-9+deb8u10 | DSA-3969-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | xen | 4.9.2-0ubuntu1 | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.6 | xen | 4.8.2-r0 | — |
| Alpine v3.5 | xen | 4.7.3-r3 | — |
| Alpine v3.4 | xen | 4.6.6-r2 | — |
Advisories 1
- DSA-3969-1 xen - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-3969 vendor-advisory
- https://xenbits.xen.org/xsa/advisory-235.html
- 1039568 vdb-entry