Loading story…
Xen published XSA-484 for CVE-2026-23557, a denial-of-service flaw in xenstored that lets an unprivileged guest crash the service by issuing the XS_RESET_WATCHES command inside a transaction. A successful trigger stops further Xenstore operations and can block domain administration on the host. The bug affects Xen from version 4.2 onward when using the C implementation of xenstored or xenstore-stubdom built without NDEBUG; oxenstored and builds compiled with NDEBUG are not affected. Xen said there is no known mitigation and advised applying patches released for xen-unstable, Xen 4.18.x, and Xen 4.17.x.
In a separate advisory, XSA-483 tracks CVE-2026-23556, a flaw in oxenstored where quota-related usage counts persist after a domain is destroyed. Because those counts survive domain ID reuse, newly created domains can be misclassified as over quota and gradually lose the ability to create Xenstore nodes, potentially degrading host operation until new domains cannot function. Xen said a buggy or malicious guest could speed up the impact by exhausting quota and rebooting repeatedly. The issue affects Xen deployments using oxenstored with the XSA-419 fixes, while systems using the C implementation xenstored are not affected; Xen recommended a xenstore live update as mitigation and released patches for Xen 4.18.x, Xen 4.17.x, and XAPI oxenstored. Both vulnerabilities were reported by Andrii Sultanov of Vates.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
On April 28, 2026, Xen publicly released Xen Security Advisory 484 v2 for CVE-2026-23557 and provided patches for xen-unstable, Xen 4.18.x, and Xen 4.17.x. Xen stated there is no known mitigation, and that oxenstored and builds with NDEBUG defined are not vulnerable.
On public release of Xen Security Advisory 483 v2, Xen disclosed CVE-2026-23556 and published patches for Xen 4.18.x, Xen 4.17.x, and XAPI oxenstored. Xen also noted that xenstore live update mitigates the issue and that systems using the C xenstored implementation are not affected.
Andrii Sultanov of Vates identified CVE-2026-23557, a denial-of-service vulnerability in xenstored triggered by issuing XS_RESET_WATCHES inside a transaction. Any unprivileged guest on affected systems can crash xenstored, disrupting Xenstore operations and domain administration.
Andrii Sultanov of Vates identified CVE-2026-23556, a bug in oxenstored where quota-related usage counts persist after domain destruction, allowing degradation over time when domain IDs are reused. The issue affects Xen deployments using oxenstored with the XSA-419 fixes applied.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcexenbits.xen.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Xen disclosed **XSA-499 v2** for two vulnerabilities, **`CVE-2026-62426`** and **`CVE-2026-62427`**, affecting sysctl and platform operations that rely on system-wide locks for privileged management tasks. The flaws stem from unfair lock acquisition, allowing a less privileged entity to repeatedly obtain locks needed by the control domain or a Xenstore domain and block other operations that cannot safely run in parallel. In deployments using **XSM/Flask**, Xen said some lock acquisitions can occur **before permission checks**, worsening the impact and enabling denial-of-service conditions that may extend to the entire host. Xen reported that all versions from **4.0 onward** are confirmed vulnerable, earlier releases may also be affected, and there is **no known mitigation** beyond applying the vendor patches; environments using Flask also need a default policy adjustment, with corresponding updates required for custom policies.
Jul 28, 2026
Xen has disclosed two Linux guest kernel vulnerabilities affecting virtualized environments, warning that both issues require patching and have no known mitigations. **CVE-2026-31786** (`XSA-485`) affects Linux kernels **4.13 and later** in Xen domains through unsafe handling of the binary build ID exposed at `/sys/hypervisor/properties/buildid`. The bug uses `sprintf()` on a non-null-terminated binary value, which can trigger an out-of-bounds read and, in rare cases, a write past the 4 KB sysfs buffer, potentially leading to **information disclosure, denial of service, or privilege escalation** inside Linux Xen guests. A second advisory, **CVE-2026-31787** (`XSA-487`), describes a **double-free** flaw in the Linux **Xen `privcmd` driver** that allows a **root user in a Linux guest** to bypass kernel lockdown protections tied to secure boot. Xen said the issue affects Linux **PVH or HVM domains** on **x86 and Arm** from kernel **3.8 onward**, while PV domains and non-Linux guests are not affected. The vulnerabilities were reported by **Frediano Ziglio of XenServer** and **Atharva Vartak (@0xAth4rv)**, respectively, and Xen urged operators to apply the supplied Linux patches.
Jun 29, 2026
The Xen Project disclosed **XSA-505** for **`CVE-2026-62432`**, a race condition in event channel handling between `EVTCHNOP_expand_array` and `EVTCHNOP_reset` that affects Xen versions **4.5 and later**. The flaw stems from checking whether FIFO event channels are enabled without holding the proper lock, which can result in a **NULL pointer dereference** inside the hypervisor. Xen said a malicious guest can exploit the bug to crash the host and cause **denial of service**: **HVM guests** on x86 HVM, PVH, and ARM are able to crash Xen, while a malicious **x86 PV guest** could likely also trigger memory corruption or possibly **privilege escalation**. Xen reported that versions **4.4 and earlier are not affected**, that **no mitigations** are available, and that remediation requires applying the vendor patch provided in **`xsa505.patch`** for xen-unstable and **Xen 4.17** in line with the project's security advisory process.
Jul 28, 2026