Skip to main content

Suse EUVDEUVD-2026-49771

| CVE-2026-42492 HIGH
Incomplete Cleanup (CWE-459)
2026-07-28 security@xen.org GHSA-2hv5-3qjg-gjqr
Information Disclosure Suse
7.5
CVSS 3.1 · Vendor: xen
Share

Severity by source

Vendor (xen) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
5.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from Vendor (xen).

CVSS VectorVendor: xen

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 28, 2026 - 18:36 vuln.today
CVSS changed
Jul 28, 2026 - 16:22 NVD
7.5 (HIGH)
CVE Published
Jul 28, 2026 - 13:18 cve.org
HIGH 7.5
CVE Published
Jul 28, 2026 - 13:18 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN_DOMCTL_get_domain_state was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear down the bitmap even in cases when it wasn't set up. Unprivileged domains can trigger that error path.

AnalysisAI

Denial-of-service in Xen's Xenstore component allows unprivileged guest domains to crash the host by triggering a bitmap teardown in an error path of the XEN_DOMCTL_get_domain_state operation. Exploit code is publicly available, though no active exploitation is confirmed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-459 – Incomplete Cleanup

View all
CVE-2017-17090 HIGH POC
7.5
CVE-2025-31650 HIGH POC
7.5
CVE-2024-28265 CRITICAL POC
9.1
CVE-2023-36468 HIGH POC
8.8
CVE-2018-18924 HIGH POC
8.8
CVE-2018-18281 HIGH POC
7.8
CVE-2025-60730 HIGH POC
7.6
CVE-2025-64775 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

EUVD-2026-49771 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy