Description
Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS) of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory pages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.18.14-1 | — |
| Debian 13 | linux | 5.18.14-1 | — |
| Debian 12 | linux | 5.18.14-1 | — |
| Debian 11 | linux | 5.10.127-2 | DSA-5191-1 |
| Debian 10 | linux | 4.19.260-1 | DLA-3131-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | xen | No fix yet | — |
| Ubuntu 26.04 LTS | xen +1 | No fix yet | — |
| Ubuntu 25.10 | xen | No fix yet | — |
| Ubuntu 24.04 LTS | xen +1 | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-48.54 | USN-5624-1 |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1020.24 | USN-5624-1 |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1020.25 | USN-5624-1 |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1024.30.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1018.24 | USN-5633-1 |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1016.19 | USN-5633-1 |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1003.5 | USN-5635-1 |
| Ubuntu 22.04 LTS | linux-ibm +1 | 5.15.0-1015.17 | USN-5683-1, USN-5633-1 |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1016.21 | USN-5655-1 |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1018.22 | USN-5624-1 |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1007.7 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1018.23 | USN-5640-1 |
| Ubuntu 22.04 LTS | linux-riscv | 5.15.0-1019.22 | — |
| Ubuntu 22.04 LTS | xen +3 | No fix yet | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux | 5.4.0-128.144 | USN-5668-1 |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1086.93 | USN-5668-1 |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1020.24~20.04.1 | USN-5624-1 |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1094.100 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1020.25~20.04.1 | USN-5624-1 |
| Ubuntu 20.04 LTS | linux-azure-fde | 5.4.0-1092.97+cvm1.1 | USN-5706-1 |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1047.52 | USN-5668-1 |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1090.98 | USN-5677-1 |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1018.24~20.04.1 | USN-5644-1 |
| Ubuntu 20.04 LTS | linux-gke | 5.4.0-1084.90 | USN-5668-1 |
| Ubuntu 20.04 LTS | linux-gke-5.15 | 5.15.0-1016.19~20.04.1 | USN-5648-1 |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1054.57 | USN-5668-1 |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-48.54~20.04.1 | USN-5623-1 |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1034.38 | USN-5668-1 |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1016.21~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1005.7 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1076.81 | USN-5668-1 |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1084.92 | USN-5668-1 |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1018.23~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1071.81 | USN-5677-1 |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1019.22~20.04.1 | — |
| Ubuntu 20.04 LTS | xen +24 | No fix yet | — |
| Ubuntu 18.04 LTS | linux | 4.15.0-194.205 | USN-5669-1 |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1142.154 | USN-5678-1 |
| Ubuntu 18.04 LTS | linux-aws-5.4 | 5.4.0-1086.93~18.04.1 | USN-5682-1 |
| Ubuntu 18.04 LTS | linux-azure-4.15 | 4.15.0-1153.168 | USN-5687-1 |
| Ubuntu 18.04 LTS | linux-azure-5.4 | 5.4.0-1094.100~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-dell300x | 4.15.0-1054.59 | USN-5669-1 |
| Ubuntu 18.04 LTS | linux-gcp-4.15 | 4.15.0-1137.153 | USN-5678-1 |
| Ubuntu 18.04 LTS | linux-gcp-5.4 | 5.4.0-1092.101~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-hwe-5.4 | 5.4.0-128.144~18.04.1 | USN-5668-1 |
| Ubuntu 18.04 LTS | linux-ibm-5.4 | 5.4.0-1034.38~18.04.1 | USN-5668-1 |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1128.133 | USN-5669-1 |
| Ubuntu 18.04 LTS | linux-oracle | 4.15.0-1107.118 | USN-5669-1 |
| Ubuntu 18.04 LTS | linux-oracle-5.4 | 5.4.0-1084.92~18.04.1 | USN-5677-1 |
| Ubuntu 18.04 LTS | linux-raspi-5.4 | 5.4.0-1071.81~18.04.1 | USN-5677-1 |
| Ubuntu 18.04 LTS | linux-raspi2 | 4.15.0-1120.128 | USN-5669-1 |
| Ubuntu 18.04 LTS | linux-snapdragon | 4.15.0-1138.148 | USN-5669-1 |
| Ubuntu 18.04 LTS | xen +15 | No fix yet | — |
| Ubuntu 16.04 LTS | xen +1 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1021.21 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1086.93+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1094.100+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1062.70 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1092.101+fips1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2081.87 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2062.68 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1099.110 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-gcp-fips | 4.15.0-2047.52 | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux-aws-hwe | 4.15.0-1142.154~16.04.1 | USN-5679-1 |
| Ubuntu Pro 16.04 LTS | linux-azure | 4.15.0-1153.168~16.04.1 | USN-5684-1 |
| Ubuntu Pro 16.04 LTS | linux-gcp | 4.15.0-1137.153~16.04.1 | USN-5695-1 |
| Ubuntu Pro 16.04 LTS | linux-hwe | 4.15.0-194.205~16.04.1 | USN-5669-2 |
| Ubuntu Pro 16.04 LTS | linux-oracle | 4.15.0-1107.118~16.04.1 | USN-5669-2 |
| Ubuntu Pro 14.04 LTS | linux +2 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1153.168~14.04.1 | USN-5684-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.15 | xen | 4.15.4-r0 | — |
| Alpine v3.14 | xen | 4.15.4-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | kernel-livepatch-4.14.287-215.504 | 1.0-0.amzn2 | ALAS2-2022-1825 |
| Amazon Linux 2 | perf +8 | 4.14.287-215.504.amzn2 | ALAS2-2022-1825 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | kernel | 5.15.67.1-4 | — |
Advisories 23
- USN-5668-1 linux, linux-aws, linux-bluefield, linux-gke, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- USN-5683-1 linux-ibm vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- USN-5682-1 linux-aws-5.4 vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- USN-5677-1 linux-gcp, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- USN-5624-1 linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-kvm, linux-lowlatency vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5644-1 linux-gcp-5.15 vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5679-1 linux-aws-hwe vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5669-2 linux-hwe, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5635-1 linux-gkeop vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5640-1 linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5678-1 linux-aws, linux-gcp-4.15 vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5655-1 linux-intel-iotg vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5648-1 linux-gke-5.15 vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5633-1 linux-gcp, linux-gke, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5669-1 linux, linux-dell300x, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5623-1 linux-hwe-5.15, linux-lowlatency-hwe-5.15 vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5684-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5687-1 linux-azure-4.15 vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5695-1 linux-gcp vulnerabilities Ubuntu Security Notices (USN) · Sep 14, 2026
- USN-5706-1 linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- DSA-5191-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3131-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ALAS2-2022-1825 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 19, 2025
References
- https://xenbits.xenproject.org/xsa/advisory-406.txt
- http://xenbits.xen.org/xsa/advisory-406.html
- [oss-security] 20220705 Xen Security Advisory 406 v3 (CVE-2022-33744) - Arm guests can cause Dom0 DoS via PV devices mailing-list
- DSA-5191 vendor-advisory
- [debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update mailing-list