Xen Hypervisor CVE-2026-23559

Patch available per vendor advisory (XSA-489); the input does not include an exact fixed Xen version number, so apply the patches referenced on https://xenbits.xen.org/xsa/advisory-489.html and rebuild or update the hypervisor from your distribution once it ships the corresponding fix, rather than an invented version string. Xen security advisories typically publish per-branch patches and an embargo/patch timeline - follow the specific patch set listed there for your Xen branch. As a compensating control until patched, restrict which guests can run on affected hosts: consolidate only trusted/first-party workloads onto vulnerable hosts and move untrusted or multi-tenant guests off them, since the attack requires code execution inside a guest (trade-off: reduced consolidation density and possible live-migration/downtime). Where feasible, reduce guest attack surface against the affected subsystem per any mitigation guidance in XSA-489 (trade-off: may disable functionality some guests rely on). Do not rely on network controls - the vector is local to the host, so firewalling does not mitigate it.