Skip to main content

Xen Hypervisor CVE-2026-62426

| EUVDEUVD-2026-49777 HIGH
Unrestricted Externally Accessible Lock (CWE-412)
2026-07-28 security@xen.org GHSA-f8j9-mrwg-r7g5
Xen
8.8
CVSS 3.1 · Vendor: xen
Share

Severity by source

Vendor (xen) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Actor is a Xen domain issuing hypercalls (AV:L, PR:L for an XSM/Flask-authorized domain); unfair system-wide lock starves host management (A:H, S:C affecting other domains); no data disclosure or integrity loss (C:N/I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE
5.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from Vendor (xen).

CVSS VectorVendor: xen

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Metadata Corrected
Sep 16, 2026 - 09:40 vuln.today
tag: Xen added
Metadata Corrected
Sep 16, 2026 - 09:40 vuln.today
tag: Information Disclosure removed
Metadata Corrected
Sep 16, 2026 - 09:40 vuln.today
tag: Python removed
Analysis Generated
Jul 28, 2026 - 16:33 vuln.today
CVSS changed
Jul 28, 2026 - 16:22 NVD
8.8 (HIGH)
CVE Published
Jul 28, 2026 - 13:19 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 28, 2026 - 13:19 cve.org
HIGH 8.8

DescriptionCVE.org

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking.

The sysctl issue is CVE-2026-62426.

The platform-op issue is CVE-2026-62427.

Articles & Coverage 2

News 11 New Python Vulnerabilities - 0 Critical, 11 High Jul 29, 2026 News 11 New Python Vulnerabilities - 0 Critical, 11 High Jul 28, 2026

AnalysisAI

Unfair, non-queued acquisition of Xen's system-wide sysctl operation lock lets a domain with hypercall access starve competing management sysctl operations, potentially blocking administrative control-plane work on the hypervisor. The realistic exposure is narrow: in a default configuration only the trusted control domain (dom0) can issue these hypercalls, and the meaningful risk appears when XSM/Flask is enabled and some sysctl operations are delegated to a less-privileged domain, where the lock is taken before the XSM permission check. Independent assessment rates this as availability-only with local, low-privilege prerequisites (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), which is materially lower than NVD's 8.8 high/high/high vector; EPSS is low at 0.23% (14th percentile), SSVC reports no exploitation and no automatable exploitation, and no public exploit has been identified at time of analysis. A companion issue for platform operations with the same lock-ordering defect is tracked separately as CVE-2026-62427.

Technical ContextAI

Xen exposes sysctl hypercalls as the interface by which the control domain (or, when XSM/Flask policy is in use, a possible Xenstore domain or other delegated domain) manages the hypervisor. Certain sysctl operations cannot run concurrently and are therefore serialized behind a single system-wide lock; CVE-2026-62426 stems from the lock-acquisition discipline, which is neither fair nor queued, and from the fact that for some operations the lock is acquired before XSM/Flask performs its permission check. This maps to CWE-412 (Unrestricted Externally Accessible Lock): a lock reachable from an externally invocable interface can be monopolized by one caller, starving other legitimate callers and degrading availability of the management path rather than exposing memory or corrupting state. The pre-permission-check ordering is the second half of the defect: a caller that would ultimately be denied by XSM can briefly occupy the global lock during the window before the authorization decision, which broadens who can exert pressure on the serialization point under a permissive XSM policy. Because the affected operations are serialization and scheduling primitives rather than data-handling paths, the demonstrated consequence is availability (management-operation starvation), with no confidentiality or integrity impact established. The same fairness/ordering weakness in the platform-op path is tracked as CVE-2026-62427; both are addressed by the Xen security advisory referenced in the sources (XSA-499).

Affected ProductsAI

Xen hypervisor builds that support sysctl hypercalls and, for the elevated-risk scenario, run XSM/Flask with sysctl permissions delegated beyond dom0 are affected. In a stock configuration the issue is largely moot because only the control domain holds hypercall access to these operations. Distribution packaging is confirmed for SUSE products, with Xen fixes shipped in SUSE-SU-2026:3409, SUSE-SU-2026:3423, SUSE-SU-2026:3451, and SUSE-SU-2026:3462 (tags indicate SUSE exposure alongside Python-related packaging and information-disclosure context in the aggregated feeds). No CPE strings were supplied with the intelligence set, so exact product/version identifiers should be taken from the platform advisories; the authoritative Xen statement is at https://xenbits.xenproject.org/xsa/advisory-499.html, with corroborating records at https://vuldb.com/vuln/383864, https://seclists.org/oss-sec/2026/q3/303, and ENISA EUVD-2026-49777.

RemediationAI

Apply the vendor fix for XSA-499; patch availability is confirmed by the vendor but no exact fixed version strings were provided in the source data, so pull the Xen hypervisor packages from the advisory https://xenbits.xenproject.org/xsa/advisory-499.html or, for SUSE deployments, from the corresponding SUSE-SU-2026:3409, SUSE-SU-2026:3423, SUSE-SU-2026:3451, or SUSE-SU-2026:3462 update and reboot into the new hypervisor. Because the flaw requires the ability to issue sysctl hypercalls, the most effective compensating control is to keep sysctl privileges confined to dom0 and avoid delegating sysctl operations to Xenstore or other less-privileged domains via XSM/Flask policy; the trade-off is loss of that delegated-management capability, and XSM policy alone will not fully mitigate the pre-permission-check lock acquisition for operations that are still delegated. Tightening XSM/Flask policy to least privilege reduces the number of domains that can pressure the global lock, but treat this as a hardening step, not a substitute for the patch. If patching must be delayed, restrict management-plane access to dom0 and monitor for sustained stalls in sysctl-driven control operations, which would be the observable symptom of lock starvation.

More in Xen

View all
CVE-2012-0217 HIGH POC
7.2 Jun 12

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and

CVE-2015-3456 HIGH POC
7.7 May 13

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a

CVE-2018-8897 HIGH POC
7.8 May 08

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) wa
CVE-2022-4949 HIGH POC
8.8 Jun 07

The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aj
CVE-2017-15595 HIGH POC
8.8 Oct 18

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recu
CVE-2017-7228 HIGH POC
8.2 Apr 04

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. Rated
CVE-2015-5165 CRITICAL
9.3 Aug 12

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
CVE-2015-8550 HIGH
8.2 Apr 14

Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (hos
CVE-2022-26364 MEDIUM POC
6.7 Jun 09

x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text exp
CVE-2017-10918 CRITICAL
10.0 Jul 05

Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obt
CVE-2017-10912 CRITICAL
10.0 Jul 05

Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217
CVE-2017-10921 CRITICAL
10.0 Jul 05

The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_h

Same weakness CWE-412 – Unrestricted Externally Accessible Lock

View all
CVE-2019-18269 CRITICAL
9.8
CVE-2023-22318 HIGH
7.5
CVE-2026-25612 MEDIUM
6.5
CVE-2026-82312 LOW
1.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-62426 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy