Vulnerability-Lookup

SUSE-SU-2026:4087-1

Vulnerability from csaf_suse - Published: 2026-09-08 12:26 - Updated: 2026-09-16 20:56

Summary

Security update for xen

Severity

Moderate

Notes

Title of the patch: Security update for xen

Description of the patch: This update for xen fixes the following issues: - CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838). - CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839). - CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).

Patchnames: SUSE-2026-4087,SUSE-SLE-Micro-5.5-2026-4087

CVE-2026-62437

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 1 product

Product	Identifier	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2026-79602

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 1 product, the same list as for CVE-2026-62437

Threats

Impact moderate

CVE-2026-79603

5.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Affected products

Recommended 1 product, the same list as for CVE-2026-62437

Threats

Impact moderate

References

16 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1276838	self
https://bugzilla.suse.com/1276839	self
https://bugzilla.suse.com/1276841	self
https://www.suse.com/security/cve/CVE-2026-62437/	self
https://www.suse.com/security/cve/CVE-2026-79602/	self
https://www.suse.com/security/cve/CVE-2026-79603/	self
https://www.suse.com/security/cve/CVE-2026-62437	external
https://bugzilla.suse.com/1276838	external
https://www.suse.com/security/cve/CVE-2026-79602	external
https://bugzilla.suse.com/1276839	external
https://www.suse.com/security/cve/CVE-2026-79603	external
https://bugzilla.suse.com/1276841	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for xen",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for xen fixes the following issues:\n\n- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).\n- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).\n- CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-4087,SUSE-SLE-Micro-5.5-2026-4087",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_4087-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:4087-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264087-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:4087-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-September/028950.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276838",
        "url": "https://bugzilla.suse.com/1276838"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276839",
        "url": "https://bugzilla.suse.com/1276839"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276841",
        "url": "https://bugzilla.suse.com/1276841"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62437 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62437/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-79602 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-79602/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-79603 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-79603/"
      }
    ],
    "title": "Security update for xen",
    "tracking": {
      "current_release_date": "2026-09-16T20:56:37Z",
      "generator": {
        "date": "2026-09-08T12:26:17Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:4087-1",
      "initial_release_date": "2026-09-08T12:26:17Z",
      "revision_history": [
        {
          "date": "2026-09-08T12:26:17Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T19:53:51Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:56:37Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-devel-4.17.6_16-150500.3.79.1.i586",
                "product": {
                  "name": "xen-devel-4.17.6_16-150500.3.79.1.i586",
                  "product_id": "xen-devel-4.17.6_16-150500.3.79.1.i586",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen-devel@4.17.6_16-150500.3.79.1?arch=i586\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.17.6_16-150500.3.79.1.i586",
                "product": {
                  "name": "xen-libs-4.17.6_16-150500.3.79.1.i586",
                  "product_id": "xen-libs-4.17.6_16-150500.3.79.1.i586",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen-libs@4.17.6_16-150500.3.79.1?arch=i586\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.17.6_16-150500.3.79.1.i586",
                "product": {
                  "name": "xen-tools-domU-4.17.6_16-150500.3.79.1.i586",
                  "product_id": "xen-tools-domU-4.17.6_16-150500.3.79.1.i586",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen-tools-domU@4.17.6_16-150500.3.79.1?arch=i586\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-tools-xendomains-wait-disk-4.17.6_16-150500.3.79.1.noarch",
                "product": {
                  "name": "xen-tools-xendomains-wait-disk-4.17.6_16-150500.3.79.1.noarch",
                  "product_id": "xen-tools-xendomains-wait-disk-4.17.6_16-150500.3.79.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen-tools-xendomains-wait-disk@4.17.6_16-150500.3.79.1?arch=noarch\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-4.17.6_16-150500.3.79.1.x86_64",
                "product": {
                  "name": "xen-4.17.6_16-150500.3.79.1.x86_64",
                  "product_id": "xen-4.17.6_16-150500.3.79.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen@4.17.6_16-150500.3.79.1?arch=x86_64\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xen-devel-4.17.6_16-150500.3.79.1.x86_64",
                "product": {
                  "name": "xen-devel-4.17.6_16-150500.3.79.1.x86_64",
                  "product_id": "xen-devel-4.17.6_16-150500.3.79.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen-devel@4.17.6_16-150500.3.79.1?arch=x86_64\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xen-doc-html-4.17.6_16-150500.3.79.1.x86_64",
                "product": {
                  "name": "xen-doc-html-4.17.6_16-150500.3.79.1.x86_64",
                  "product_id": "xen-doc-html-4.17.6_16-150500.3.79.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen-doc-html@4.17.6_16-150500.3.79.1?arch=x86_64\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.17.6_16-150500.3.79.1.x86_64",
                "product": {
                  "name": "xen-libs-4.17.6_16-150500.3.79.1.x86_64",
                  "product_id": "xen-libs-4.17.6_16-150500.3.79.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen-libs@4.17.6_16-150500.3.79.1?arch=x86_64\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-32bit-4.17.6_16-150500.3.79.1.x86_64",
                "product": {
                  "name": "xen-libs-32bit-4.17.6_16-150500.3.79.1.x86_64",
                  "product_id": "xen-libs-32bit-4.17.6_16-150500.3.79.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen-libs-32bit@4.17.6_16-150500.3.79.1?arch=x86_64\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-4.17.6_16-150500.3.79.1.x86_64",
                "product": {
                  "name": "xen-tools-4.17.6_16-150500.3.79.1.x86_64",
                  "product_id": "xen-tools-4.17.6_16-150500.3.79.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen-tools@4.17.6_16-150500.3.79.1?arch=x86_64\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.17.6_16-150500.3.79.1.x86_64",
                "product": {
                  "name": "xen-tools-domU-4.17.6_16-150500.3.79.1.x86_64",
                  "product_id": "xen-tools-domU-4.17.6_16-150500.3.79.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:xen:xen:4.17.6_16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/xen-tools-domU@4.17.6_16-150500.3.79.1?arch=x86_64\u0026upstream=xen-4.17.6_16-150500.3.79.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.5",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.5",
                  "product_id": "SUSE Linux Enterprise Micro 5.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.17.6_16-150500.3.79.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64"
        },
        "product_reference": "xen-libs-4.17.6_16-150500.3.79.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-62437",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62437"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process.  Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew.  While some of those tracking structures would still be cleaned up\nlater on, at least one would not be.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62437",
          "url": "https://www.suse.com/security/cve/CVE-2026-62437"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276838 for CVE-2026-62437",
          "url": "https://bugzilla.suse.com/1276838"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-08T12:26:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-62437"
    },
    {
      "cve": "CVE-2026-79602",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-79602"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A guest with a PCI device assigned that has at least a BAR on the IO port\nspace can trigger a BUG() in Xen.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-79602",
          "url": "https://www.suse.com/security/cve/CVE-2026-79602"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276839 for CVE-2026-79602",
          "url": "https://bugzilla.suse.com/1276839"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-08T12:26:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-79602"
    },
    {
      "cve": "CVE-2026-79603",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-79603"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "x86 PV guests can free memory pages while still keeping a stale TLB entry\npointing to them.  A TLB flush is only issued by Xen (if needed) when the\npage is re-used.  Since it\u0027s possible for the page to be scrubbed ahead of\nthe TLB flush, there\u0027s a window where a PV guest can modify an already\nscrubbed page.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-79603",
          "url": "https://www.suse.com/security/cve/CVE-2026-79603"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276841 for CVE-2026-79603",
          "url": "https://bugzilla.suse.com/1276841"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.5:xen-libs-4.17.6_16-150500.3.79.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-08T12:26:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-79603"
    }
  ]
}

CVE-2026-62437 (GCVE-0-2026-62437)

Vulnerability from cvelistv5 – Published: 2026-09-08 12:10 – Updated: 2026-09-10 18:13

Title

x86: DMs may cause mem leak by IRQ binding

Summary

When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 18:11 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

XEN mitre root

References

3 references

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-509.html
http://xenbits.xen.org/xsa/advisory-509.html
http://www.openwall.com/lists/oss-security/2026/09/08/6

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-509

Date Public

2026-09-08 12:00

Credits

This issue was discovered by Jan Beulich of SUSE.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-08T17:08:26.757Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-509.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62437",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T18:11:30.445915Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T18:13:23.073Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-509"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from at least 3.2 onwards are affected.  Older versions\nhave not been inspected.\n\nOnly HVM guests with assigned PCI devices can leverage the vulnerability."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Jan Beulich of SUSE."
        }
      ],
      "datePublic": "2026-09-08T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process.  Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew.  While some of those tracking structures would still be cleaned up\nlater on, at least one would not be."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A HVM guest with one or more PCI devices assigned can cause a memory leak\nin the hypervisor, possibly leading to Denial of Service (DoS) of the\nentire host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T12:10:52.643Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-509.html"
        }
      ],
      "title": "x86: DMs may cause mem leak by IRQ binding",
      "workarounds": [
        {
          "lang": "en",
          "value": "Running only PV or PVH guests will avoid the vulnerability.\n\nRunning only HVM guests without passing through PCI devices to them will\nalso avoid the vulnerability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62437",
    "datePublished": "2026-09-08T12:10:52.643Z",
    "dateReserved": "2026-07-14T10:28:12.655Z",
    "dateUpdated": "2026-09-10T18:13:23.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79602 (GCVE-0-2026-79602)

Vulnerability from cvelistv5 – Published: 2026-09-08 12:11 – Updated: 2026-09-10 18:08

Title

x86: improper handling of HVM emulation return codes

Summary

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 18:08 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

XEN mitre root

References

3 references

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-510.html
http://xenbits.xen.org/xsa/advisory-510.html
http://www.openwall.com/lists/oss-security/2026/09/08/7

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-510

Date Public

2026-09-08 12:00

Credits

This issue was discovered by Jiqian Chen of AMD and diagnosed as a security issue by Roger Pau Monné of AMD.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-08T17:08:32.715Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-510.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/7"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-79602",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T18:08:16.213605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T18:08:59.554Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-510"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Xen versions 4.6 and later are vulnerable.  This is known to be the case\nwith the fix for XSA-491, but it\u0027s possible the issue can also be\ntriggered from other, non-analyzed paths.\n\nOnly x86 systems are vulnerable.  Arm systems are not vulnerable.\n\nOnly HVM guests with a PCI device with IO BARs assigned can leverage the\nvulnerability."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Jiqian Chen of AMD and diagnosed as a\nsecurity issue by Roger Pau Monn\u00e9 of AMD."
        }
      ],
      "datePublic": "2026-09-08T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A guest with a PCI device assigned that has at least a BAR on the IO port\nspace can trigger a BUG() in Xen."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Passing through a PCI device with at least one BAR in IO address space to\nunprivileged HVM guests can result in a Denial of Service (DoS) affecting\nthe entire host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T12:11:08.534Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-510.html"
        }
      ],
      "title": "x86: improper handling of HVM emulation return codes",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no mitigation available."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-79602",
    "datePublished": "2026-09-08T12:11:08.534Z",
    "dateReserved": "2026-08-25T07:35:05.289Z",
    "dateUpdated": "2026-09-10T18:08:59.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79603 (GCVE-0-2026-79603)

Vulnerability from cvelistv5 – Published: 2026-09-08 12:11 – Updated: 2026-09-08 17:08

Title

Unconditionally do TLB flushing ahead of page scrubbing

Summary

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 13:42 UTC

CWE

CWE-664 - Improper Control of a Resource Through its Lifetime

Assigner

XEN mitre root

References

3 references

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-511.html
http://xenbits.xen.org/xsa/advisory-511.html
http://www.openwall.com/lists/oss-security/2026/09/08/8

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-511

Date Public

2026-09-08 12:00

Credits

This issue was discovered by Roger Pau Monné of AMD.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-08T17:08:33.807Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-511.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/8"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-79603",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T13:42:37.092287Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-664",
                "description": "CWE-664 Improper Control of a Resource Through its Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T13:42:41.424Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-511"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from 4.13 onwards are vulnerable.  Xen versions 4.12 and\nearlier are not vulnerable as they lack the `scrub-domheap` command line\noption.\n\nOnly x86 PV guests can exploit the vulnerability."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Roger Pau Monn\u00e9 of AMD."
        }
      ],
      "datePublic": "2026-09-08T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "x86 PV guests can free memory pages while still keeping a stale TLB entry\npointing to them.  A TLB flush is only issued by Xen (if needed) when the\npage is re-used.  Since it\u0027s possible for the page to be scrubbed ahead of\nthe TLB flush, there\u0027s a window where a PV guest can modify an already\nscrubbed page."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Deployments using `xsm=silo scrub-domheap` with the aim of not allowing the\nexchange of information amongst guests are not effective in the presence of\nPV guests."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T12:11:21.789Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-511.html"
        }
      ],
      "title": "Unconditionally do TLB flushing ahead of page scrubbing",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no known mitigation."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-79603",
    "datePublished": "2026-09-08T12:11:21.789Z",
    "dateReserved": "2026-08-25T07:35:05.289Z",
    "dateUpdated": "2026-09-08T17:08:33.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:4087-1

CVE-2026-62437 (GCVE-0-2026-62437)

CVE-2026-79602 (GCVE-0-2026-79602)

CVE-2026-79603 (GCVE-0-2026-79603)

Tags

Sightings

Nomenclature

Related by attack behaviour