Skip to main content

Xen Hypervisor CVE-2026-62428

| EUVDEUVD-2026-49779 HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-07-28 security@xen.org GHSA-qmxg-rhxf-8273
Information Disclosure
7.8
CVSS 3.1 · Vendor: xen
Share

Severity by source

Vendor (xen) PRIMARY
7.8 HIGH
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Malicious guest (AV:L/PR:L) must win a pinned-grant race (AC:H); TOCTOU crosses the isolation boundary (S:C) enabling cross-domain memory read, write, and corruption/crash (C:H/I:H/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
8.1 HIGH
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (xen).

CVSS VectorVendor: xen

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Jul 28, 2026 - 16:45 vuln.today
CVE Published
Jul 28, 2026 - 13:19 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 28, 2026 - 13:19 cve.org
HIGH 7.8

DescriptionCVE.org

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.

AnalysisAI

A local time-of-check/time-of-use (TOCTOU) race in the Xen hypervisor's grant-table copy handling lets a provisioned guest domain subvert the permission check that is supposed to gate a grant-copy operation, so the check can be performed against one guest frame while the actual copy targets a different frame. Only guests able to issue GNTTABOP_copy operations - a standard capability for PV/HVM guests doing grant-based I/O - are affected, and the attacker must win a narrow timing window in which the referenced grant is simultaneously pinned by another mapping or copy (reflected in the CVSS AC:H rating); it is not remotely reachable and requires guest-level privilege. Given the local attack vector, the required race, and an EPSS score of 0.10% (1st percentile), this is a genuine hypervisor-level confidentiality and integrity flaw but not an urgent widespread-exploitation priority; no public exploit has been identified at time of analysis and CISA SSVC records exploitation as 'none'.

Technical ContextAI

The Xen hypervisor brokers inter-domain memory sharing through the grant table: a guest (the grantor) advertises pages that other domains may map or copy via hypercalls such as GNTTABOP_copy. When a copy is requested, the hypervisor looks up the referenced guest frame and validates permissions before performing the copy on behalf of the calling domain. CVE-2026-62428 is a CWE-367 time-of-check/time-of-use race: if the grant is already 'pinned' by another concurrently active operation (a mapping or another copy), the state supplied back to the hypervisor for the permission check may not correspond to the page that is ultimately the subject of the copy. The check and the use therefore operate on different pages, allowing a malicious or compromised guest to have permission validated against one frame while data is read or written on another. Because the flaw crosses the guest/hypervisor trust boundary and can affect memory belonging to other domains, the assessed vector carries Scope:Changed (S:C) with High confidentiality and integrity impact (C:H/I:H) and High availability impact (A:H), at AV:L/AC:H/PR:L/UI:N - i.e., local guest access, a hard-to-win race, and guest-level privilege, with no user interaction. The issue was reported by security@xen.org and is documented as Xen Security Advisory XSA-500.

Affected ProductsAI

The affected component is the Xen hypervisor's grant-table copy implementation, covered by Xen Security Advisory XSA-500 (https://xenbits.xenproject.org/xsa/advisory-500.html), which applies across the supported Xen release branches rather than to a single named version; no CPE strings were supplied in the available intelligence, so exact version ranges should be taken from the XSA-500 advisory text. Downstream, the flaw is packaged and patched in SUSE products, with vendor update advisories SUSE-SU-2026:3409, SUSE-SU-2026:3423, SUSE-SU-2026:3451 and SUSE-SU-2026:3462 addressing affected SUSE Linux Enterprise/Xen packages. Additional context and mirrored advisory data are available via the EUVD entry EUVD-2026-49779, the oss-security posting (https://seclists.org/oss-sec/2026/q3/304), the Openwall list thread (http://www.openwall.com/lists/oss-security/2026/07/28/16), and VulDB entry 383867. Any environment whose guests can issue GNTTABOP_copy operations - essentially all PV and HVM guests using grant-based I/O - should be treated as potentially affected until the host is patched.

RemediationAI

Patch available per vendor advisory: apply the fixes referenced by Xen Security Advisory XSA-500 (https://xenbits.xenproject.org/xsa/advisory-500.html), and for SUSE-based hosts apply the corresponding vendor updates SUSE-SU-2026:3409, SUSE-SU-2026:3423, SUSE-SU-2026:3451 and SUSE-SU-2026:3462. Because the flaw is in the hypervisor itself, the fix must be applied at the host level and the Xen daemon/toolstack restarted and guest domains rebooted (or the host rebooted) so all domains run under the patched hypervisor; simply updating guest kernels will not remediate it. There is no reliable configuration workaround, since GNTTABOP_copy is fundamental to guest I/O and cannot be disabled without breaking normal guest operation - so the practical compensating control is trust-boundary restriction: avoid consolidating mutually untrusted guests on the same vulnerable host, keep untrusted tenants on dedicated or separately patched hosts, and, where feasible, avoid co-locating a driver domain or other privilege-heavy domain with untrusted guests. The trade-off for these compensating measures is reduced consolidation density and higher infrastructure cost, and they reduce but do not eliminate exposure because any guest on the same host can attempt the race. Prioritize patching on multi-tenant hosts and any host running untrusted or externally sourced guests; single-tenant hosts with only fully trusted domains face negligible risk and can be scheduled later.

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8
CVE-2026-25641 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-62428 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy