Loading story…
The Xen Project disclosed XSA-505 for CVE-2026-62432, a race condition in event channel handling between EVTCHNOP_expand_array and EVTCHNOP_reset that affects Xen versions 4.5 and later. The flaw stems from checking whether FIFO event channels are enabled without holding the proper lock, which can result in a NULL pointer dereference inside the hypervisor.
Xen said a malicious guest can exploit the bug to crash the host and cause denial of service: HVM guests on x86 HVM, PVH, and ARM are able to crash Xen, while a malicious x86 PV guest could likely also trigger memory corruption or possibly privilege escalation. Xen reported that versions 4.4 and earlier are not affected, that no mitigations are available, and that remediation requires applying the vendor patch provided in xsa505.patch for xen-unstable and Xen 4.17 in line with the project's security advisory process.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Xen Security Advisory 505 v2 disclosed CVE-2026-62432, a race condition in event channel handling between EVTCHNOP_expand_array and EVTCHNOP_reset that can let a malicious guest crash Xen. The advisory said Xen versions 4.5 onward are vulnerable, no mitigations are available, and the issue is fixed by applying xsa505.patch for xen-unstable / Xen 4.17.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Xen disclosed **XSA-486** for `CVE-2026-23558`, a race condition in grant table v2 status page mapping that affects Xen **4.0 and later**. The flaw can be triggered on **x86 HVM and PVH guests** when a guest switches grant table versions from v2 to v1 while simultaneously mapping status pages through `XENMEM_add_to_physmap`, potentially leaving freed status pages mapped in secondary P2M page tables. Xen said successful exploitation could result in **privilege escalation, information disclosure, or denial of service**, including impact to the entire host. The issue does **not** affect Xen 3.4 and earlier, cannot be exploited by x86 PV guests, and is not supported on Arm because grant table v2 is unavailable there. Xen published patches for **xen-unstable**, **Xen 4.19.x**, and maintained branches from **4.18.x through 4.17.x**. As a mitigation, administrators can force grant table version 1 with: ```bash gnttab=max-ver:1 max_grant_version=1 ``` Xen credited **Claude Opus 4.6** with discovering the bug and **Rafal Wojtczuk** with identifying it as a security issue.
Jun 29, 2026
Xen has disclosed two Linux guest kernel vulnerabilities affecting virtualized environments, warning that both issues require patching and have no known mitigations. **CVE-2026-31786** (`XSA-485`) affects Linux kernels **4.13 and later** in Xen domains through unsafe handling of the binary build ID exposed at `/sys/hypervisor/properties/buildid`. The bug uses `sprintf()` on a non-null-terminated binary value, which can trigger an out-of-bounds read and, in rare cases, a write past the 4 KB sysfs buffer, potentially leading to **information disclosure, denial of service, or privilege escalation** inside Linux Xen guests. A second advisory, **CVE-2026-31787** (`XSA-487`), describes a **double-free** flaw in the Linux **Xen `privcmd` driver** that allows a **root user in a Linux guest** to bypass kernel lockdown protections tied to secure boot. Xen said the issue affects Linux **PVH or HVM domains** on **x86 and Arm** from kernel **3.8 onward**, while PV domains and non-Linux guests are not affected. The vulnerabilities were reported by **Frediano Ziglio of XenServer** and **Atharva Vartak (@0xAth4rv)**, respectively, and Xen urged operators to apply the supplied Linux patches.
Jun 29, 2026
Xen published **XSA-484** for `CVE-2026-23557`, a denial-of-service flaw in **xenstored** that lets an unprivileged guest crash the service by issuing the `XS_RESET_WATCHES` command inside a transaction. A successful trigger stops further Xenstore operations and can block domain administration on the host. The bug affects Xen from version 4.2 onward when using the C implementation of xenstored or `xenstore-stubdom` built without `NDEBUG`; **oxenstored** and builds compiled with `NDEBUG` are not affected. Xen said there is **no known mitigation** and advised applying patches released for **xen-unstable**, **Xen 4.18.x**, and **Xen 4.17.x**. In a separate advisory, **XSA-483** tracks `CVE-2026-23556`, a flaw in **oxenstored** where quota-related usage counts persist after a domain is destroyed. Because those counts survive domain ID reuse, newly created domains can be misclassified as over quota and gradually lose the ability to create Xenstore nodes, potentially degrading host operation until new domains cannot function. Xen said a buggy or malicious guest could speed up the impact by exhausting quota and rebooting repeatedly. The issue affects Xen deployments using **oxenstored** with the **XSA-419** fixes, while systems using the C implementation **xenstored** are not affected; Xen recommended a xenstore live update as mitigation and released patches for **Xen 4.18.x**, **Xen 4.17.x**, and **XAPI oxenstored**. Both vulnerabilities were reported by **Andrii Sultanov of Vates**.
Jun 29, 2026