Xen Hypervisor EUVD-2026-37888

Apply the XSA-491 patches distributed by the Xen Project: xsa491-4.21.patch targets Xen 4.17.x through 4.21.x stable branches, and xsa491.patch targets xen-unstable. Downstream distributions are advised to update to the tip of the relevant stable branch before applying, as patches are prepared against stable branch tips and may not apply cleanly to release tarballs. Patch availability is confirmed by the Xen Security Team with published SHA256 checksums; however, a specific released version number incorporating the fix has not been independently confirmed from the available data - treat this as 'upstream fix available via patch.' If patching is not immediately possible, the documented workaround is to run only PV (paravirtualized) or PVH guests, which eliminates the HVM I/O port translation path entirely and removes the attack surface; the trade-off is loss of HVM guest support, which may be operationally disruptive. Critically, the advisory explicitly warns that switching from a stub-domain or de-privileged device model to a fully privileged Dom0 device model does NOT mitigate the vulnerability - it only reclassifies the attacker as 'hostile management code' and should not be adopted as a compensating control. Advisory reference: https://seclists.org/oss-sec/2026/q2/857.