https://vulnogram.org/ Most recent CVEs assigned by Xen Project (xen). https://vulnogram.org/seaview/icons/xen.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-102700 https://vulnogram.org/CVE-2026-102700 With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to… Medium Tue, 13 Oct 2026 15:45:27 GMT https://vulnogram.org/CVE-2026-102702 https://vulnogram.org/CVE-2026-102702 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GN… High Network Exploitable Tue, 13 Oct 2026 15:45:13 GMT https://vulnogram.org/CVE-2026-102699 https://vulnogram.org/CVE-2026-102699 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GN… High Network Exploitable Tue, 13 Oct 2026 15:45:13 GMT https://vulnogram.org/CVE-2026-79611 https://vulnogram.org/CVE-2026-79611 For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. Th… Medium Tue, 13 Oct 2026 15:44:56 GMT https://vulnogram.org/CVE-2026-79610 https://vulnogram.org/CVE-2026-79610 XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the… High Tue, 13 Oct 2026 15:44:42 GMT https://vulnogram.org/CVE-2026-79609 https://vulnogram.org/CVE-2026-79609 XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by h… High Tue, 13 Oct 2026 15:44:24 GMT https://vulnogram.org/CVE-2026-79608 https://vulnogram.org/CVE-2026-79608 The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed a… Critical Network Exploitable Tue, 13 Oct 2026 15:44:08 GMT https://vulnogram.org/CVE-2026-79607 https://vulnogram.org/CVE-2026-79607 During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wron… Medium Tue, 13 Oct 2026 15:43:43 GMT https://vulnogram.org/CVE-2026-79603 https://vulnogram.org/CVE-2026-79603 x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a wind… Medium Tue, 08 Sep 2026 12:11:21 GMT https://vulnogram.org/CVE-2026-79602 https://vulnogram.org/CVE-2026-79602 A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen. High Tue, 08 Sep 2026 12:11:08 GMT https://vulnogram.org/CVE-2026-62437 https://vulnogram.org/CVE-2026-62437 When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the proce… Medium Tue, 08 Sep 2026 12:10:52 GMT https://vulnogram.org/CVE-2026-62434 https://vulnogram.org/CVE-2026-62434 A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen. Medium Network Exploitable Tue, 28 Jul 2026 12:33:08 GMT https://vulnogram.org/CVE-2026-62433 https://vulnogram.org/CVE-2026-62433 Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialize… High Network Exploitable Tue, 28 Jul 2026 12:32:59 GMT https://vulnogram.org/CVE-2026-62432 https://vulnogram.org/CVE-2026-62432 The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer. High Network Exploitable Tue, 28 Jul 2026 12:32:52 GMT https://vulnogram.org/CVE-2026-62431 https://vulnogram.org/CVE-2026-62431 The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault. High Network Exploitable Tue, 28 Jul 2026 12:32:43 GMT https://vulnogram.org/CVE-2026-62430 https://vulnogram.org/CVE-2026-62430 Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest… High Network Exploitable Tue, 28 Jul 2026 12:32:33 GMT https://vulnogram.org/CVE-2026-62429 https://vulnogram.org/CVE-2026-62429 Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest. Medium Tue, 28 Jul 2026 12:32:24 GMT https://vulnogram.org/CVE-2026-62436 https://vulnogram.org/CVE-2026-62436 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to… Medium Network Exploitable Tue, 28 Jul 2026 12:32:16 GMT https://vulnogram.org/CVE-2026-62435 https://vulnogram.org/CVE-2026-62435 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to… Medium Network Exploitable Tue, 28 Jul 2026 12:32:16 GMT https://vulnogram.org/CVE-2026-62428 https://vulnogram.org/CVE-2026-62428 When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already activ… High Tue, 28 Jul 2026 12:32:07 GMT https://vulnogram.org/CVE-2026-62427 https://vulnogram.org/CVE-2026-62427 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some o… High Tue, 28 Jul 2026 12:31:57 GMT https://vulnogram.org/CVE-2026-62426 https://vulnogram.org/CVE-2026-62426 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some o… High Tue, 28 Jul 2026 12:31:57 GMT https://vulnogram.org/CVE-2026-62425 https://vulnogram.org/CVE-2026-62425 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-co… Medium Tue, 28 Jul 2026 12:31:41 GMT https://vulnogram.org/CVE-2026-62424 https://vulnogram.org/CVE-2026-62424 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-co… Medium Tue, 28 Jul 2026 12:31:41 GMT https://vulnogram.org/CVE-2026-62423 https://vulnogram.org/CVE-2026-62423 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-co… Medium Tue, 28 Jul 2026 12:31:41 GMT https://vulnogram.org/CVE-2026-42495 https://vulnogram.org/CVE-2026-42495 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-co… Medium Tue, 28 Jul 2026 12:31:41 GMT https://vulnogram.org/CVE-2026-42494 https://vulnogram.org/CVE-2026-42494 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-co… Medium Tue, 28 Jul 2026 12:31:41 GMT https://vulnogram.org/CVE-2026-42492 https://vulnogram.org/CVE-2026-42492 Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN_DOMCTL_get_domain_state was introduced. The management of the bitmap underlying that operation is t… High Network Exploitable Tue, 28 Jul 2026 12:31:28 GMT https://vulnogram.org/CVE-2026-42493 https://vulnogram.org/CVE-2026-42493 Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to… High Network Exploitable Tue, 28 Jul 2026 12:31:11 GMT https://vulnogram.org/CVE-2026-42486 https://vulnogram.org/CVE-2026-42486 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://… Critical Thu, 09 Jul 2026 15:16:34 GMT https://vulnogram.org/CVE-2026-23562 https://vulnogram.org/CVE-2026-23562 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://… Critical Thu, 09 Jul 2026 15:15:24 GMT https://vulnogram.org/CVE-2026-23561 https://vulnogram.org/CVE-2026-23561 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://… Critical Thu, 09 Jul 2026 15:13:22 GMT https://vulnogram.org/CVE-2026-23560 https://vulnogram.org/CVE-2026-23560 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://… Critical Thu, 09 Jul 2026 15:12:00 GMT https://vulnogram.org/CVE-2026-23559 https://vulnogram.org/CVE-2026-23559 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://… Critical Thu, 09 Jul 2026 15:09:51 GMT https://vulnogram.org/CVE-2026-23556 https://vulnogram.org/CVE-2026-23556 When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. When the domain ID is eventually reused, the new domain can create fewer nodes before beeing deemed to be over quota. Critical Thu, 09 Jul 2026 14:48:56 GMT https://vulnogram.org/CVE-2025-58151 https://vulnogram.org/CVE-2025-58151 varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TO… Critical Thu, 09 Jul 2026 14:45:16 GMT https://vulnogram.org/CVE-2025-58146 https://vulnogram.org/CVE-2025-58146 There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 enc… Critical Thu, 09 Jul 2026 14:42:22 GMT https://vulnogram.org/CVE-2025-27464 https://vulnogram.org/CVE-2025-27464 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are ther… Critical Thu, 09 Jul 2026 14:35:38 GMT https://vulnogram.org/CVE-2025-27463 https://vulnogram.org/CVE-2025-27463 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are ther… Critical Thu, 09 Jul 2026 14:29:49 GMT https://vulnogram.org/CVE-2025-27462 https://vulnogram.org/CVE-2025-27462 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are ther… Critical Thu, 09 Jul 2026 14:27:03 GMT https://vulnogram.org/CVE-2026-42488 https://vulnogram.org/CVE-2026-42488 Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache. High Network Exploitable Thu, 18 Jun 2026 13:47:23 GMT https://vulnogram.org/CVE-2026-42490 https://vulnogram.org/CVE-2026-42490 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain… Medium Thu, 18 Jun 2026 13:47:13 GMT https://vulnogram.org/CVE-2026-42489 https://vulnogram.org/CVE-2026-42489 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain… Medium Thu, 18 Jun 2026 13:47:13 GMT https://vulnogram.org/CVE-2026-42487 https://vulnogram.org/CVE-2026-42487 HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while… High Thu, 18 Jun 2026 13:46:53 GMT https://vulnogram.org/CVE-2026-23558 https://vulnogram.org/CVE-2026-23558 The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. S… High Tue, 19 May 2026 12:49:54 GMT https://vulnogram.org/CVE-2026-23557 https://vulnogram.org/CVE-2026-23557 Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note… Medium Tue, 19 May 2026 12:49:42 GMT https://vulnogram.org/CVE-2026-23555 https://vulnogram.org/CVE-2026-23555 Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path. Note that the crash is forced via a failing asser… High Mon, 23 Mar 2026 06:57:07 GMT https://vulnogram.org/CVE-2026-23554 https://vulnogram.org/CVE-2026-23554 The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however i… High Mon, 23 Mar 2026 06:56:52 GMT https://vulnogram.org/CVE-2026-23553 https://vulnogram.org/CVE-2026-23553 In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks… Low Wed, 28 Jan 2026 15:33:44 GMT https://vulnogram.org/CVE-2025-58150 https://vulnogram.org/CVE-2025-58150 Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of… High Wed, 28 Jan 2026 15:33:17 GMT