Skip to main content

Xen Hypervisor CVE-2026-42488

| EUVDEUVD-2026-37891 HIGH
Buffer Overflow (CWE-119)
2026-06-09 GHSA-7jcv-rhv5-mq52
Buffer Overflow
8.1
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE
7.5 HIGH
AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jun 09, 2026 - 14:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Shadow paging error paths in Xen Hypervisor 4.15+ on x86 allow 64-bit PV guests operating in shadow mode to corrupt mapcache metadata by triggering a page-table switch that does not update the currently running vCPU reference. Successful exploitation by a guest can result in privilege escalation into the hypervisor, host-wide denial of service, and information leaks affecting all co-resident guests. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all supported stable branches.

Technical ContextAI

The vulnerability resides in Xen's shadow paging subsystem on x86. Shadow paging is a technique wherein the hypervisor maintains shadow copies of guest page tables; it is activated during live guest migration or when deployed as a mitigation for the L1TF speculative execution vulnerability (XSA-273 / CVE-2018-3646). In certain error paths within the shadow paging code, a page-table switch occurs without a corresponding update to the currently running vCPU's internal reference. This desynchronizes the loaded page-tables from the mapcache metadata - the mapcache being Xen's internal mechanism for mapping guest physical pages into the hypervisor's address space. Corruption of the mapcache breaks hypervisor memory isolation invariants in ways exploitable by a guest. Notably, the vulnerability is only reachable on deployments that have already applied the fix for XSA-438, meaning the XSA-438 patch introduced or exposed the conditions for this new flaw. No CWE classification was provided in the source data; the root cause pattern is consistent with a state-management error in error-path handling (analogous to CWE-362 or CWE-667), but this is inferred rather than confirmed.

Affected ProductsAI

Xen Hypervisor 4.15 and all later versions are vulnerable, specifically any build that carries the fix for XSA-438. The vulnerability is exclusive to x86 architecture; ARM and other platforms are not affected. Within x86, only 64-bit PV (paravirtualized) guests can trigger the flaw, and only while those guests operate under shadow paging mode - either during live migration or when shadow mode is enabled as a workaround for XSA-273 (L1TF). Vendor patches have been released for Xen 4.17.x, 4.18.x, 4.19.x through 4.20.x, 4.21.x, and xen-unstable. No CPE strings were included in the source data.

RemediationAI

The primary fix is to apply the signed patches released by the Xen Project under XSA-494: use xsa494-4.17.patch for Xen 4.17.x, xsa494-4.18.patch for Xen 4.18.x, xsa494-4.20.patch for Xen 4.19.x through 4.20.x, xsa494-4.21.patch for Xen 4.21.x, and xsa494.patch for xen-unstable. The Xen Project advises updating to the tip of the relevant stable branch before applying patches, as patches are prepared against stable branches and may not apply cleanly to release tarballs. Patch checksums are published in the advisory at https://seclists.org/oss-sec/2026/q2/860 for integrity verification. If immediate patching is not feasible, two workarounds fully eliminate the attack surface: (1) Convert all PV guests to HVM or PVH guest types - this removes PV shadow mode entirely but requires guest OS changes and potentially driver adjustments; (2) Run PV guests inside the PV shim, which avoids the vulnerable code path at the cost of additional emulation overhead and potential performance impact. Simply disabling live migration of PV guests would remove one trigger for shadow mode but would not fully mitigate if shadow mode is also active as the XSA-273 workaround.

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8
CVE-2017-6736 HIGH POC
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed
SUSE Linux Enterprise Micro 5.5 Fixed
SUSE Linux Enterprise Server 15 SP5-LTSS Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed

Share

CVE-2026-42488 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy