Xen oxenstored CVE-2026-23556

Apply the fix from Xen Security Advisory 483 (https://xenbits.xen.org/xsa/advisory-483.html); patch available per vendor advisory, though an exact fixed version string was not included in the provided data, so pull the patched packages referenced in XSA-483 for your Xen branch. As a compensating control where immediate patching is not possible, switch the Xenstore daemon from oxenstored to the C xenstored if your deployment supports it (trade-off: behavioral/performance differences between the two implementations and a configuration change requiring host reconfiguration), and/or restrict the ability of untrusted guests to rapidly create and destroy domains and Xenstore state (trade-off: constrains legitimate automation/orchestration that spins domains up and down frequently). Monitor oxenstored quota accounting and restart the daemon/host if counters approach exhaustion as a stopgap.