Skip to main content

Suse CVE-2026-62430

| EUVDEUVD-2026-49783 HIGH
Race Condition (CWE-362)
2026-07-28 security@xen.org GHSA-w4qm-qcx6-wmw8
Information Disclosure Race Condition Suse
7.5
CVSS 3.1 · Vendor: xen
Share

Severity by source

Vendor (xen) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE
2.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (xen).

CVSS VectorVendor: xen

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
Jul 28, 2026 - 16:33 vuln.today
Severity Changed
Jul 28, 2026 - 16:22 NVD
LOW HIGH
CVSS changed
Jul 28, 2026 - 16:22 NVD
3.3 (LOW) 7.5 (HIGH)
CVE Published
Jul 28, 2026 - 13:19 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 28, 2026 - 13:19 cve.org
HIGH 7.5

DescriptionCVE.org

Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.

AnalysisAI

Information disclosure in Xen hypervisor's CMOS emulation allows a guest VM to exploit a race condition in the index caching mechanism, leading to an out-of-bounds read of hypervisor memory. A malicious guest can repeatedly manipulate the CMOS index port while the hypervisor processes an access, potentially leaking sensitive data from the host or other VMs. No active exploitation or public exploit code is known at this time.

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2015-5754 CRITICAL POC
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-62430 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy